Coinfinity

Financial surveillance protects no one. It hands robbers the addresses. Since January, every crypto provider in the EU has to record who buys bitcoin, sells it or moves it to their own wallet. From 2027 the data goes to the tax office every year, and it is kept for ten years. The EU calls this DAC8. France shows where such data ends up. In January, thieves took the gains and holdings of customers of the crypto tax service Waltio, and investigators believe gangs used the list to pick victims for home invasions. In February, an attacker posing as an official pulled the records of 1.2 million accounts from the national bank account register. A tax officer near Paris is on trial for allegedly selling data from the tax system to organized crime, including data on crypto investors. French prosecutors count well over a hundred crypto kidnappings and attempts since 2023. Austrian criminal law has a precise standard for this. Intent already covers anyone who seriously considers a crime possible and accepts it (§ 5 StGB). Anyone who contributes to another person’s crime counts as a perpetrator too (§ 12 StGB). Lawmakers know about the leaks and the kidnappings, and they keep the collection running. A private citizen who listed his neighbors’ names, addresses and wealth, knowing that such lists end up with robbers, would be an accomplice. The state obliges every provider to keep exactly such lists. Against crime, the surveillance barely works. The money laundering researcher Ronald Pol estimates that the entire anti-money-laundering regime touches less than 0.1 percent of criminal proceeds and costs more than a hundred times what it recovers. What it protects is the tax collector’s reach into everyone who owns something. The robbers take what the list shows them, and the state takes the rest. Two challenges are under way. In Austria, @bitcoin_at has filed a complaint, backed by @coinfinity, to bring DAC8 before the Constitutional Court. In France, @BullBitcoin_ asked the Conseil d’État in February to annul the French decree, which goes even further than the directive. Both refuse to treat a hit list as a routine compliance task, which is rarer in this industry than it should be. Austria’s Constitutional Court struck down data retention in 2014. I hope DAC8 meets the same end before the first Austrian list appears on the darknet.