France’s highest administrative court has refused to pause the country’s new crypto tax reporting decree, rejecting an emergency bid by Bitcoin platform Bull Bitcoin and exchange Paymium who warned that centralizing user data could put crypto holders in physical danger.
By Maria Rodriguez | September 17, 2026
The Hook: Court Finds No Urgency to Freeze the Rules
On September 17, France’s Council of State — the country’s top administrative court — turned down an emergency request to suspend the French decree implementing the European Union’s DAC8 crypto tax reporting framework. The companies behind the filing, Bull Bitcoin and Paymium, had asked the court to freeze the rules while a separate case seeking to strike down the decree entirely works its way through the system.
The court saw no reason to hit the emergency brake. In a line quoted by Bull Bitcoin from the decision, the judges wrote that “the mere possibility of a risk, the probability of which is very low, cannot constitute a situation of urgency.” In plain terms: the judges agreed a security risk exists in theory, but not a big enough one to justify suspending the reporting regime tomorrow.
For regular investors in France, the practical meaning is simple: DAC8 reporting stays in force. Crypto platforms will keep collecting and transmitting identifying information about users and their transactions to the tax authority. If you trade on a registered French or EU exchange, your data is already part of this pipeline.
On-Chain Evidence: Why the Companies Are Worried
The companies’ core argument is not about taxes — it is about physical safety. Bull Bitcoin and Paymium contend that pooling information about who owns crypto, and how much they own, into databases accessible for tax reporting creates a honeypot for criminals. If such a database were ever compromised, the leaked files would let attackers identify holders and their families for kidnapping, extortion, or robbery.
That concern is not hypothetical in France. According to figures attributed to Interior Minister Laurent Nuñez, France recorded 77 crypto-linked cases of kidnapping, unlawful detention, extortion, or attempted offenses by early July 2026 — up from 45 in all of 2025. Around 200 people have been arrested in connection with attacks or preventive operations. Blockchain security firm CertiK counted 52 verified physical crypto attacks worldwide in the first half of 2026, with France accounting for 33 of them, and estimated total financial exposure at roughly 124 million USD. Chainalysis documented 46 physical attacks globally through late June, with home invasions making up 37 percent of them.
Perhaps the sharpest detail in the filing: Bull Bitcoin pointed to comments by France’s own tax authority, the General Directorate of Public Finances, made during parliamentary discussions in February. According to the company, the authority itself warned that a general declaration system for crypto portfolios would centralize sensitive identity and asset data — exactly the kind of records that attract hackers.
The Core Conflict: Tax Transparency vs. Holder Safety
This case frames a tension that every crypto investor in Europe should understand. On one side stands DAC8, an EU directive that obliges crypto-asset service providers to report customer information so tax authorities can track who owes what — the crypto equivalent of the banking world’s automatic information-sharing agreements. Governments argue this closes loopholes and levels the playing field.
On the other side sit the platforms arguing that crypto holders face a risk bank customers do not: physical targeting. Analysts have even suggested compromised personal information, including allegations involving stolen tax records containing investor data, may be a factor behind the concentration of violent attacks in France — though no direct link between specific breaches and individual attacks has been established.
Important caveat: today’s ruling settles only the question of urgency. It does not decide whether the decree is legal. Bull Bitcoin emphasized that its main annulment case remains pending, and the company read the court’s silence on the substance as a hopeful sign — an interpretation that remains the company’s view, not a court finding.
Market Implications: What It Means for Your Wallet
For French and broader European investors, the decree staying in place means continued normalization of crypto tax enforcement. If you have been accurate on your declarations, little changes. If you have not, the window for quiet non-compliance is closing across the EU, as member states roll out their DAC8 implementations.
The bigger question is operational: how securely the collected data is stored. The court’s decision effectively bets that government databases can be protected well enough. With France’s documented wave of physical crypto crime, that bet will be watched closely — and further legal challenges, including Bull Bitcoin’s main case, will keep pressure on the system.
The Verdict
The Council of State’s refusal is a win for regulators and a setback for platforms hoping to slow DAC8’s rollout. But the underlying annulment case continues, and France’s crypto-crime statistics ensure the security argument will not disappear. For investors, the takeaway is practical: assume your exchange data is reported, keep your tax filings clean, and pay attention to physical-security hygiene — the data-protection debate around who knows you hold crypto is now front and center in Europe.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
77 crypto linked kidnappings and extortion cases in france by july and the court writes that the risk probability is very low. tell that to the families
the quote is doing heavy lifting. the court never denied the risk, they just dont think its urgent enough to suspend the whole DAC8 regime. cold comfort for holders
cold comfort is generous. suspension was the only ruling that could be undone if wrong. refusing it means the harm runs while the paperwork crawls
very low probability, next to 77 documented cases by july. the council of state writes like none of those people have a home address
77 cases by july and the phrase tres faible still made it into a ruling. tells you everything about who writes these opinions and who they think reads them
tres faible while the police blotters keep filling up. courts treating physical risk like a rounding error is exactly how the ledger leak escalation played out
they write these opinions from offices with police protection. the people on the dac8 registry list their own home addresses
77 documented cases by july and they still wrote very low probability. courts gonna court
very low probability next to 77 documented cases by july is the court deciding those victims statistically dont exist
exactly. the conseil treated it like a paperwork dispute while people were getting pulled into vans over their ledger holdings. one centralized trove of who owns what is a target list, calling that risk very low is wild
a centralized database of who owns what, and the council of state basically decided kidnapping risk is a tomorrow problem. bold
and its not just france, dac8 is EU wide. one centralized register per country, each with a different level of incompetence
bull bitcoin arguing a centralized holder database is a kidnapping honeypot is the most french bitcoin thing possible. and honestly theyre right
bull bitcoin has a point though. everyone forgot the ledger data leak in 2020 already? people got home visits over that
exactly, the Ledger leak led to real threats and extortion. calling the danger hypothetical is revisionism
and the ledger leak was one retailers database. dac8 aggregates every french platform into one registry, its a target list with a search bar
remember the 2020 leak spreadsheet, people got threatened over balances crooks only knew from one file. now imagine one clean national registry of holders
paymium joining bull bitcoin on the suit is the interesting bit. exchanges usually welcome this kind of decree since compliance costs kill the small ones
paymium joining is less surprising when you remember they got hit with the 2023 account freeze mess. they know exactly which side of a state database an exchange ends up on
paymium joined because fighting a french court they cant win costs less than looking complicit in a holder database. either way small exchanges eat the compliance bill
the court suspends only for serious and irreversible harm. 77 kidnapping and extortion cases by july apparently does not clear that bar. absurd standard
the part nobody mentions: even if they win the main case later, the registry data collected in between doesnt vanish. you cant un-collect a database
one breach of the dac8 register and every sized holder in france is a target. the council of state decided thats an acceptable risk for the rest of us
one registry is one point of failure with a search bar built in. the cnil lectures small e-commerce sites about splitting data, then the state builds this
Refusing the suspension means the decree stays live while the court decides whether it was even legal to begin with. The ordering of that is completely backwards for the people exposed in the meantime.