France’s top court rejects emergency challenge to DAC8 crypto decree

France’s Council of State has rejected an emergency request from Bull Bitcoin and Paymium to suspend the French decree implementing the European Union’s DAC8 crypto tax reporting rules while a separate challenge seeking to annul the measure remains before the court.

Bull Bitcoin said in a Sept. 17 statement on X that the summary suspension proceeding was filed in August 2026 and focused on what the companies described as immediate security risks created by collecting and centralizing information about cryptocurrency users.

The proceeding was separate from a legal challenge launched earlier this year against the decree itself. Bull Bitcoin said the first case contests the legality of the French implementation of DAC8, while the second sought to stop its application until the Council of State reaches a decision on the underlying dispute.

Council of State finds no urgent grounds to suspend DAC8

In rejecting the emergency request, the Council of State found that Bull Bitcoin and Paymium had not established a level of urgency sufficient to justify suspending the decree.

“The mere possibility of a risk, the probability of which is very low, cannot constitute a situation of urgency,” the court said, according to an excerpt of the decision published by Bull Bitcoin.

The companies had argued that concentrating information about crypto users in databases accessible for tax reporting creates a security risk if the records are compromised. Data collected under the regime can include information identifying users and details of their crypto transactions.

Bull Bitcoin said leaked information could allow criminals to identify cryptocurrency holders and their families for kidnapping, extortion or other physical attacks.

The company disputed the court’s assessment of the risk, pointing to comments made by France’s General Directorate of Public Finances during parliamentary discussions in February. According to Bull Bitcoin, the tax authority warned that a general declaration system for crypto portfolios could centralize sensitive information, including holders’ identities and the value of their assets, making such records attractive targets for hackers.

Bull Bitcoin said the emergency ruling dealt only with whether there was sufficient urgency to suspend the decree and did not resolve the arguments raised in its main case.

“This refusal in no way means that the Council of State rejects our substantive arguments, and concerns only the grounds of urgency,” the company said.

Bull Bitcoin further said it interpreted the absence of comments on its substantive arguments as a positive sign for the main proceeding. That interpretation represents the company’s view of the ruling, while the Council of State has yet to decide the merits of the annulment challenge.

France faces growing debate over crypto holder data

The security argument comes amid a series of physical attacks targeting cryptocurrency holders and their relatives in France.

As crypto.news previously reported, France had recorded 77 crypto linked cases involving kidnapping, unlawful detention, extortion or attempted offenses during 2026 by early July, according to Interior Minister Laurent Nuñez. The comparable figure for 2025 was 45.

Around 200 people had been arrested following attacks or preventive operations, while authorities introduced measures including stronger intelligence sharing and rapid identification systems for industry participants considered at risk.

Blockchain security firm CertiK separately recorded 52 verified physical crypto attacks worldwide during the first half of 2026, with France accounting for 33 of them. Its dataset put total financial exposure from the incidents at $124.1 million, including stolen assets, ransom demands, frozen funds and other values associated with the cases.

Chainalysis counted 46 documented physical crypto attacks globally through late June, of which 12 resulted in payments to attackers. More than $30 million was taken in successful incidents during the period, while home invasions represented 37% of documented attacks.

The analytics firm identified compromised personal information as a possible factor behind the concentration of attacks in France, citing allegations involving stolen tax records containing investor information. It stopped short of establishing a direct link between specific data breaches and individual attacks.

Physical attacks have continued in recent months. In August, a French couple was kidnapped from their home in Rion-des-Landes in an alleged crypto extortion case. Attackers reportedly sought access to Bitcoin and other cryptocurrency holdings, while two suspects were later arrested.

Another couple in Alès was tied up and threatened by armed intruders in late August. The attackers demanded cryptocurrency transactions and remained inside the home for more than two hours before fleeing as police arrived.

DAC8 expands crypto tax reporting across the EU

DAC8 entered into application across the European Union on Jan. 1, 2026, expanding automatic tax information exchange rules to crypto assets.

Reporting crypto asset service providers must collect information on reportable transactions carried out by EU resident users. Required customer information can include names, addresses, tax identification numbers, dates of birth and tax residence details.

The rules cover crypto to fiat transactions, exchanges between crypto assets and certain transfers. Self custody wallet withdrawals can fall within the reporting framework when they involve a reporting service provider.

Providers are collecting reportable information covering the 2026 calendar year, with the first reporting and automatic exchange of the data scheduled for 2027.

The regime is expected to give tax authorities substantially more information about crypto activity. Chainalysis estimated that France generated $9.4 billion in potentially taxable crypto activity during 2025 across the six blockchains included in its study.

The estimate consisted of $1.7 billion in crypto income, $2.5 billion in realized gains and $5.2 billion in payments. Chainalysis described the figures as potentially taxable activity and did not characterize the full amount as unpaid taxes or government revenue.

French taxpayers reported €368 million in crypto gains for 2024 through roughly 24,000 tax filings, though the figure covers a different period and category of activity and is not directly comparable with the Chainalysis estimate.

Bull Bitcoin continues annulment challenge

Bull Bitcoin said its original proceeding seeking the complete annulment of the French DAC8 decree remains active before the Council of State.

The company said the case challenges the government’s authority to implement the decree and raises arguments concerning fundamental rights and European privacy protections.

Following the rejection of the emergency proceeding, Bull Bitcoin said it plans to publish its filings, supporting documents and arguments from the suspension case in the coming days.

“We are waging this war against mass surveillance on multiple fronts and in multiple countries,” the company said. “We have won battles and suffered setbacks.”

Under the DAC8 implementation timetable, crypto asset service providers must report information covering the 2026 calendar year by Sept. 30, 2027, before the data is automatically exchanged among EU tax authorities.