Bull Bitcoin challenged France's new crypto tax rule. The data risk is now officially in court.
DAC8 was sold as tax reporting. Bull Bitcoin says France just built a map of who owns crypto, where they trade, and who can be targeted.
CryptoVibe Desk · regulation · france · dac8
- →Bull Bitcoin filed at France's Conseil d'État to annul Decree No. 2025-1276, the French rule implementing DAC8.
- →The company says DAC8 turns licensed exchanges into identity funnels and makes crypto users less safe, not more compliant.
- →By the end of 2026, watch whether France defends the safety risk or the court suspends the decree.
- DAC8 → DAC8 is an EU tax rule that makes crypto service providers report user identity and transaction data to tax authorities.
- MiCA → MiCA is the EU rulebook that licenses and supervises crypto companies across member states.
- Conseil d'État → The Conseil d'État is France's top administrative court for challenges against government rules.
Cointelegraph says up to 135 million European crypto holders sit inside DAC8's reporting net.
Bull Bitcoin has now taken that number to France's Conseil d'État. The MiCA-licensed, non-custodial Bitcoin exchange wants the court to annul Decree No. 2025-1276. That decree brings DAC8 into French law. The thesis is simple: tax reporting becomes a security problem when the state builds one large identity map.
Bull Bitcoin's case is not anti-tax theater. It argues that DAC8 moves sensitive user data from licensed crypto companies into multi-country reporting networks. Those networks have more access points and weaker direct accountability. If you're a French crypto holder, your bag is no longer just your exchange's database problem.
That matters because France already has a physical-risk problem. Bitcoin Magazine, citing Bull Bitcoin's materials, says France ranks second globally for physical attacks on crypto users after the United States. The filing points to named victims including Binance France CEO David Prinçay and Ledger co-founder David Balland. Balland lost a finger during an attack.
The data history is not comforting. Bitcoin Magazine says the France Titres breach exposed 11.7 million to 19 million accounts as of April 15, 2026. It also says a French national bank account registry hack exposed about 1.2 million accounts. In the United States, Equifax hit 147 million people in 2017. National Public Data hit over 200 million in 2024, according to the same source.
Bull Bitcoin's sharper claim is that DAC8 undercuts MiCA, DORA, and GDPR from inside the same rulebook. Regulated exchanges have money and legal reasons to protect customers. DAC8 forces them to send user data into a broader administrative machine. The numbers don't add up if the weakest database becomes the real policy.
The caveat matters. Bitcoin Magazine's article is based on Bull Bitcoin's press release. Cointelegraph corroborates the filing, but no independent French government response is in the brief. The Conseil d'État has not ruled.
Still, the posture is unusual. Bull Bitcoin is not an offshore exchange yelling from outside the gates. It is a regulated CASP, licensed under MiCA by France's AMF, challenging the rule from inside the system. That makes this the first serious EU test of whether directive-based data collection can fall on safety grounds.
If the court lets the decree stand without forcing France to defend the data risk, DAC8 becomes the template. If Bull Bitcoin wins even a partial suspension, every EU crypto tax database starts looking less inevitable.
France's finance ministry chose central data pooling over user safety, and Bull Bitcoin is right to force that choice into court before DAC8 scales across licensed exchanges.
By the end of 2026, watch whether the Conseil d'État suspends or annuls Decree No. 2025-1276, because anything short of that leaves DAC8 intact.
Primary links and supporting reads used by the desk for this story.
Forward this.
