Bull Bitcoin Challenges French Court Ruling on DAC8 Decree

Bull Bitcoin has asked France’s top administrative court, the Conseil d’État, to overturn the French rules implementing the EU’s DAC8 crypto tax reporting framework. The exchange argues that the system could create a large, centralized database linking people’s legal identities and addresses to their crypto transactions—an outcome it says could heighten physical safety risks for crypto holders.

DAC8, which started applying on January 1, 2026, requires qualifying crypto service providers to collect customer identity and transaction details and then report them to French tax authorities. Those authorities would automatically share the information with counterparts across EU member states under the directive’s information-exchange model.

Key takeaways

• Bull Bitcoin has filed a petition with the Conseil d’État to challenge France’s DAC8 implementation, arguing it could enable a “mass database” of identity and address-linked transaction data.


• France implemented DAC8 through Decree No. 2025-1276, signed December 19, 2025, with the rules in effect from January 1, 2026.


• Under DAC8, the first reports covering the 2026 calendar year are due by September 30, 2027, after which EU authorities plan to exchange the data automatically.


• Bull Bitcoin said it filed a summary petition on February 24 before submitting a substantive brief, and it wants the effects of DAC8—and the OECD’s global CARF framework—to be suspended, delayed, annulled, or amended.


• The exchange’s appeal highlights concerns about data-security incidents and criminal targeting of crypto holders, including “wrench attacks.”

Why Bull Bitcoin is challenging DAC8 in France

In its petition announcement, Bull Bitcoin framed its legal action as a response to what it views as an avoidable concentration of sensitive information. According to the exchange, DAC8 could effectively connect legal identity and home addresses with crypto transaction histories, including transfers that may have no direct relevance to tax obligations.

Bull Bitcoin also linked its challenge to a broader security and safety concern. In its statement, the exchange warned that the creation of such a dataset would be dangerous for crypto holders’ physical safety, especially given the industry’s history of data-related incidents and the rise in kidnappings targeting people believed to hold crypto assets.

Legally, Bull Bitcoin said it first filed a summary petition on February 24, then followed with a substantive legal brief laying out its arguments. The exchange said it plans to pursue “every legitimate avenue” to seek court intervention—specifically asking for the ability to suspend, delay, annul, or amend the effects of DAC8 in France and its global counterpart, the OECD’s CARF.

DAC8 reporting timeline and the mechanics of data exchange

The exchange’s case sits inside a specific implementation schedule. Under DAC8, crypto service providers must submit initial reports that cover the 2026 calendar year by September 30, 2027. After that initial filing, tax authorities within EU member states would exchange the reported information automatically.

France’s role in this system matters because it already has an enacted implementation measure: Decree No. 2025-1276, signed on December 19, 2025. With DAC8 in force since January 1, 2026, the reporting pipeline is moving from planning to operational data collection—meaning the exchange’s challenge arrives as compliance steps are likely becoming concrete.

Bull Bitcoin’s argument emphasizes not only how the reporting is structured, but also what the information exchange could mean in practice. If identity-linked transaction records are compiled and shared across borders, the potential harm from any data exposure—intentional or accidental—could scale beyond a single service provider or jurisdiction.

CARF alignment and OECD’s role in globalizing reporting

Bull Bitcoin’s petition also explicitly references CARF, the “Crypto-Asset Reporting Framework” developed by the Organisation for Economic Co-operation and Development (OECD). While DAC8 is EU-specific, CARF is intended to provide a common reporting standard so jurisdictions can collect and exchange information on crypto-related activity in a similar way.

That connection is central to Bull Bitcoin’s stated objective. The exchange indicated it is not only targeting the immediate effects of DAC8 but also challenging what it described as its “global counterpart” under CARF. For investors and users, the practical implication is that a French legal fight may carry relevance for how other countries interpret or apply similar reporting expectations—especially if CARF-based systems are adopted broadly.

Linking regulatory data flows to wrench attacks and breach risks

Bull Bitcoin’s warning draws a line between compliance reporting and heightened criminal pressure on crypto holders. The exchange pointed out that France has been among the countries most affected by “wrench attacks,” in which victims are threatened or assaulted to force them to transfer digital assets.

Earlier reporting referenced in the underlying coverage notes that French police counted 41 crypto-related kidnappings since the start of 2026, according to RTL. The broader trend is also supported by cybersecurity analysis cited in the same context: CertiK reported wrench attacks increased by 75% in 2025 to 72 verified global cases. In that dataset, France had the most incidents during 2025 with 19 confirmed cases, and Europe accounted for roughly 40% of worldwide incidents.

Bull Bitcoin’s concerns are also tied to the industry’s exposure to customer data breaches. In May 2025, Coinbase stated that less than 1% of its transacting monthly users were affected in an attack that may cost the exchange up to $400 million in reimbursement expenses—an example used to underscore the potential consequences of any large-scale accumulation of sensitive records.

The tension at the heart of Bull Bitcoin’s argument is straightforward: tax transparency measures require identifying details and transaction information, but the exchange contends that the same capabilities can be repurposed by criminals if data protection fails—or if the mere existence of identity-linked reporting makes targeting more efficient.

With Bull Bitcoin’s case now before the Conseil d’État, the key question for market participants is how the court weighs tax enforcement goals against privacy, security, and proportionality concerns. Until the court decision—and any potential interim measures—readers should watch closely for developments in how quickly compliant reporting processes ramp up in France and whether similar challenges emerge elsewhere in the EU as DAC8 enforcement continues.

https://www.cryptobreaking.com/bull-bitcoin-challenges-french-court/?utm_source=blogger%20&utm_medium=social_auto&utm_campaign=Bull%20Bitcoin%20Challenges%20French%20Court%20Ruling%20on%20DAC8%20Decree%20