Crypto Holders Targeted in France as DAC8 Data Centralization Raises Physical Risk

That gap may shrink. Since January 1, 2026, the European DAC8 directive requires crypto exchange platforms to report client transactions to tax authorities. The reported data includes full name, address, date and place of birth, tax identification number, wallet value as of December 31, and the total volume of buys and sells for the year. The information is centralized in government databases meant for AML compliance.

A recent breach in Île-de-France showed how that pool of data can be tapped. Tax agent Ghalia C. is under investigation for illegally accessing the “Mira” database – a system for ultra-sensitive tax files – and passing confidential information to criminals, according to Yahoo Finance. She was paid via Western Union and targeted public figures, prison guards, and crypto investors, who were described as ideal prey for extortion. The case illustrated one vulnerability of the new reporting regime: the same data collected to fight crime can be used by criminals if access controls fail.

The Marseille investigation is still open. Upcoming details may clarify how the suspects identified their victims and where the information came from. For crypto holders in France, the combination of DAC8 data centralization and a track record of physical attacks suggests that personal security – not just wallet security – deserves attention. The 2026 reporting cycle will produce fresh balance snapshots. What happens to that data after it lands in government systems is the open question.