A bank reports your annual balance and the interest you earned, that's it.

DAC8, the EU's crypto reporting directive, forces crypto platforms to report your identity, including your home address and date of birth, your tax residence, and your full transaction history: every acquisition, disposal, transfer, deposit and withdrawal, including transactions that have no relevance whatsoever to any tax event.

Not even a bank is subject to this level of detail.

Here's why that matters beyond principle. Government databases holding this kind of data do not have a clean track record:

• A DGFiP tax agent in Bobigny was jailed in January 2026 for selling home addresses and tax profiles to criminals, specifically targeting cryptocurrency investors
• In Italy, corrupt police officers accessed tax, police and bank databases and exfiltrated over a million records, resold or used for blackmail (the Equalize case, 2024-2026)
• Bulgaria's tax authority had the data of 5 to 7 million citizens, nearly its entire adult population, exfiltrated through what investigators called basic techniques
• In 18 months, more than 100 million records of French citizens were compromised from databases run by the French state or its contractors
• France's own privacy regulator logged 8,613 breach notifications in the last 12 months, roughly one every hour

And when crypto-specific data leaks, it doesn't stay abstract: the Waltio breach (a French crypto tax platform) directly served at least three kidnappings, according to French authorities.

That is the exact same category of database DAC8 now creates, at a scale French authorities themselves describe as up to 1000x larger, shared across 27 tax administrations instead of one platform.

https://preview.redd.it/6rlkjrcl64ch1.jpg?2752&format=pjpg&auto=webp&s=e4f06cc6e02214a928237e6d84ef9d94e6bef150

The physical-risk numbers are trending the wrong way at the same time this rollout is happening:

• Wrench attacks (physical coercion to extract crypto) rose 75% in 2025, then another 41% in Q1 2026 versus Q1 2025.
• Europe now accounts for 82% of global crypto-related physical attacks, France alone for 70%.
• Over half of 2026 victims held no crypto at all, they were spouses, children or elderly parents of holders. $101M was extorted in just the first four months of 2026.

https://preview.redd.it/calhsqk074ch1.png?1672&format=png&auto=webp&s=aad9a409ab2271bf1b362704325fdfe303ccd7e8

This is the proportionality argument we're now making in court.

We've filed a legal challenge before France's Conseil d'État to annul the French decree implementing DAC8, arguing the scale of data collection exceeds what fighting tax fraud actually requires, and that concentrating this much identity-linked financial data in a database already proven leakable creates a security risk that outweighs whatever fraud it prevents.

Full case, sources and figures on STOP DAC8: DAC8.COM

Given this track record, is a shared 27-country database actually more secure than the status quo, or just a bigger target?