A file on every crypto customer. Time to draw a line.

Anyone who buys bitcoin through an exchange, a broker or an app has been on a list for the tax office since the start of this year, without any suspicion. And it does not stop there: the data travels on, stays stored for years, and data like this is lost in data leaks again and again. In the worst case, it becomes a target list for fraudsters, extortionists and kidnappers: who holds how much, or is thought to, along with their home address.

Today we are launching a campaign against it at dac8.org, supported by Coinfinity. The goal: for Austria’s Constitutional Court and the Court of Justice of the European Union to put an end to this financial mass surveillance.

The list is based on the EU directive DAC8. Providers have long kept records on their customers. From 2027, they will automatically report each customer’s name, home address and annual totals to the tax office, in Austria, in Germany and across the EU. The first step against it has been taken: in October, lawyer Dr Oliver Völkel (CERHA HEMPEL) filed a complaint with the Austrian Data Protection Authority at our initiative.

From list to target #

Nobody would put up with this for cash. And bitcoin is like cash: whoever gets hold of the data knows where a break-in pays off. Providers, tax tools and authorities have already lost data of this kind on around 46 million people. France’s Interior Ministry alone counted 77 crypto-related kidnappings and extortions, attempts included, in the first half of 2026.

First normal, then banned #

Surveillance grows step by step, under the cover of taxes and the fight against money laundering. Until 2000, the anonymous savings book was a matter of course in Austria; today anonymous accounts are banned. From 2027, merchants may accept no more than 10,000 euros in cash, and because such limits do not rise with inflation, they catch more of everyday life each year. For bitcoin there is no limit at all: anyone transferring through a provider is on record by name from the first cent. The results are meagre: in 2025, Austria received 13,989 money-laundering suspicion reports, and there were 139 convictions.

Two fronts #

And it is about more than money: payments reveal how people live, what they believe and whom they support. Privacy needs no justification, but it does need people to defend it, on two fronts: with better and simpler tools that let anyone keep their bitcoin themselves and pay privately, and in court. 2014 shows that this can work: the Court of Justice of the European Union struck down the EU’s data retention law, in part on a referral from Austria’s Constitutional Court.

A European front #

The first move came from Francis Pouliot’s company Bull Bitcoin, which has been challenging DAC8 in France since February. “The only thing I can guarantee you is that we will never give up,” Pouliot writes in the campaign’s manifesto. We invite everyone in Europe who stands up for privacy to join.

Get involved #

dac8.org shows how a report to the tax office can become a target list for criminals, who is affected, and how to support the proceedings with a donation in euros or bitcoin. Donate now

For media: kontakt@dac8.org. Legal questions: Dr Oliver Völkel, LL.M., Partner at CERHA HEMPEL.