DAC8 Is a Kidnapping Factory (Francis Pouliot)

↓ Jump to the video and timestamps

Francis Pouliot hasn't been on the show in seven years. The last time we sat down was San Francisco, Bitcoin 2019, the day I found out my wife was expecting our first child. A lot has happened since then. Bitcoin has persisted through every wave of noise, my sons have grown up a bit, and Francis has been quietly building one of the most principled Bitcoin exchanges on earth while fighting battles most of the industry refuses to even acknowledge.

He came back on this week and I'm genuinely grateful he did, because what he walked me through on DAC8, CARF, and what's happening to Bitcoiners in France right now is the kind of thing that should be front-page news in every Bitcoin publication on the planet. It isn't. That's part of the problem. A supranational, unelected bureaucratic architecture that nobody voted for is quietly converting every crypto exchange in Europe into a mass surveillance relay. The government data it's collecting is already being sold to criminal gangs, and people are being kidnapped at a rate of roughly once every two and a half days in France alone. Bull Bitcoin is the only company on earth that has mounted a legal challenge to stop it.

We also got into chain analysis, the Clarity Act, Pay Join, silent payments, and why the cypherpunk stack is more alive than the blackpillers want you to believe. This one mattered.

Key takeaways

• DAC8 is a complete break from existing KYC law. Under the old regime, exchanges kept user data internally and reported suspicious activity on warrant. DAC8 requires streaming all user data annually to national tax authorities regardless of any suspicion, then sharing that data across all 27 EU member state agencies, creating a continental honeypot with no historical precedent.
• France's government data leaks are already getting Bitcoiners kidnapped. Convicted civil servants have sold crypto user records to criminal gangs. By Francis Pouliot's count, roughly 80 crypto users were kidnapped in France in 2025; he projects 150 to 180 in 2026, a pace of once every two and a half days in Q1 alone.
• Bull Bitcoin's legal challenge is the only one of its kind on earth. Filed in February 2026, challenging DAC8's French implementation on proportionality, EU Charter of Human Rights, and procedural grounds. The first mandatory DAC8 reporting deadline is January 31, 2027. If French courts rule against them, the fight goes to the European Court of Justice.
• CARF is heading to the US and Canada. The OECD framework behind DAC8 is coming to Canada in 2026 and to the US around 2028 or 2029 by Francis's read. No American company or politician has mounted a legal or legislative challenge.
• Chain analysis is a warrant factory the industry built itself. Never legally mandated in any jurisdiction, based on a provably false heuristic, and already putting people in prison. Judges treat probabilistic PDFs as fingerprint-level evidence. The defense in the Roman Sterlingov / Bitcoin Fog case was denied the ability to audit the black box.
• The cypherpunk privacy stack has never been stronger. Pay Join v1 is stable. Bull Bitcoin has integrated Pay Join into the exchange. A silent payments pull request was opened in the Bull Wallet the morning Francis and I recorded. AI tooling is accelerating cypherpunk builders faster than state surveillance infrastructure can respond.

What DAC8 Actually Is (And Why Almost Nobody Knows)

Most people in Bitcoin have never heard of DAC8. That's by design, and Francis made that clear from the jump.

The backstory: in 2021, at the peak of COVID-era technocratic confidence, the G20 countries decided that Bitcoin posed an existential threat to governments' ability to finance themselves. Tax evaders using Bitcoin were going to bankrupt the state, the logic went, and something had to be done. So the G20 mandated the OECD to build a solution. What they produced is called CARF, the Crypto Asset Reporting Framework. Roughly 70 countries pledged to implement it. In Europe, that implementation came through as DAC8, the eighth iteration of the Directive on Administrative Cooperation.

Here's what DAC8 actually does. Under the KYC regime that existed before, an exchange like Bull Bitcoin kept user data internally. If there was a police investigation, law enforcement showed up with a warrant and got what they needed. Francis told me that Bull Bitcoin gets something like that request once a year. The vast majority of user data never leaves the company.

DAC8 blows that model up entirely. Every year, exchanges must report all user data to their national tax authority: identity, home address, transaction volumes, cost of acquisition, everything. Reporting is required across the board, with no warrant and no suspicion of wrongdoing needed.

And then it gets worse. DAC8 allows EU countries to share that data with each other. Bull Bitcoin is incorporated in France, so it reports to the French tax authority. The French tax authority then shares that data with the German tax authority, the Dutch tax authority, and every other EU member state. What you end up with is a centralized list of every Bitcoin buyer in Europe, how much they bought, and how much they sold, sitting in 27 different government databases simultaneously.

Francis's framing of the shift was precise: "What DAC8 does is a complete shift because now the government requires us to send all of the data. Regardless of whether you're like a pleb or you're a whale, whether you're sketchy or not sketchy, all of the data gets sent to the government."

That's not a marginal extension of the old system. It's a different system entirely.

France Is the Crypto Kidnapping Capital of the World

This is the part that should make anyone building or using a Bitcoin exchange in Europe sit up and pay attention.

France's government cybersecurity is, by Francis's account, catastrophically bad. He describes a pattern of repeated large-scale data breaches hitting top-tier institutions, tax authorities, government agencies, and major insurers. And it isn't just passive leakage. French civil servants have been convicted of selling crypto user records directly to criminal gangs. These gangs then use that data to identify victims, track them down, and kidnap them for Bitcoin ransoms.

Francis's numbers, which he presents as his estimates based on his position inside the French Bitcoin industry: roughly 80 crypto-related kidnappings in France in 2025. He projects 150 to 180 in 2026. In Q1 2026, the pace was running at once every two and a half days. He told me he personally knows four or five people whose family members have been kidnapped, including well-known figures in the French Bitcoin community.

"So you have government bureaucrats which are collecting data on crypto users and selling that data to the mafia," Francis said. "And what is the result? The result is France, where again we are based, is the crypto kidnapping capital of the world."

I want to be direct about what this means for DAC8. We are not talking about a hypothetical future harm. We are talking about a documented, convicted-criminal pipeline that runs from government data collection to physical violence. And DAC8's mandate is to expand that data collection dramatically, share it across 27 more government bureaucracies, and do it annually on every user whether or not there's any suspicion of wrongdoing.

My point when we got into it: sharing across 27 EU agencies doesn't just multiply the exposure linearly. In an era when AI can be pointed at critical infrastructure rather trivially, competent security policy would be moving in the opposite direction, minimizing data collection, not building a mega global honeypot of every Bitcoin holder in Europe. The attack surface DAC8 creates is catastrophic by design, not by accident.

I think the proof is in the pudding of 50 years of KYC AML, which really stems from the Bank Secrecy Act here in the United States. These data collection mandates are completely ineffective at stopping crime. And as Francis made viscerally clear, they're actively putting people in harm's way.

Bull Bitcoin's Legal Challenge Is the Only One on Earth

In February 2026, Bull Bitcoin filed a legal challenge against DAC8's implementation in France. Francis kept it quiet until Bull Bitcoin secured its MICA license on June 22, 2026. He didn't want to wave a red flag at the French regulatory state while the licensing process was still live. Once the license was secured, they went public.

The challenge runs on three grounds. First, proportionality: the French government already has the tools to investigate tax evasion; building a pan-European database of all crypto users is completely disproportionate to that stated objective. Second, the EU Charter of Human Rights. Third, procedural and technical errors in how France implemented the directive. There is one co-plaintiff, another French crypto exchange, the only other company Francis found willing to take this on.

The legal strategy is multi-layered. Repeal is the primary goal: get the French implementation struck down entirely, which would exempt Bull Bitcoin from complying. A secondary track seeks temporary suspension of the compliance requirement while the case proceeds. A fallback, plan C in Francis's framing, involves negotiating to mitigate the most harmful elements. If the French courts rule against them, the case goes to the European Court of Justice.

Francis was clear that this is not a frivolous lawsuit. There are legal precedents, particularly around proportionality challenges in EU law, that give this real teeth. And the timeline matters: data tracking began January 1, 2026. The first mandatory annual report is due January 31, 2027.

What struck me most is that Bull Bitcoin is doing this alone. As Francis put it: "As far as I know, Bull is the only company in the world doing a legal challenge to CARF anywhere on earth." One other French exchange joined as co-plaintiff. That's it. Nobody else had the guts.

CARF is coming to Canada in 2026 by Francis's read. It's coming to the United States around 2028 or 2029. No American company, no American politician in the so-called pro-Bitcoin political coalition, has mounted anything resembling a challenge. Francis said it plainly: "There's no congressman or parliamentarian that really and truly does anything about it." He's right, and it's embarrassing.

The COVID Playbook, Applied to Your Bank Account

Francis drew the parallel explicitly, and I think it's the most useful frame for understanding how this happens.

With COVID, there was the WHO. The WHO can't force any country to do anything. But national public health bureaucrats get what Francis called a "software update" from the WHO, cook up an emergency, and start issuing edicts. Nobody voted for lockdowns or vaccine mandates. They came from the bureaucracy, coordinated internationally, slipping under the radar of representative government.

FATF operates the same way. It's an intergovernmental body that issues guidelines. Countries aren't legally obligated to implement them, but if they don't, they get flagged as non-cooperative states, ending up on FATF's gray list or blacklist. The pressure is enormous. So national finance bureaucrats quietly implement FATF guidelines as technical amendments, with no congressional debate, no parliamentary vote, no protest in the streets.

"You will not find a congressional debate where you have the Democrats and Republicans arguing back and forth about the merits of CARF," Francis said. "It's like a technical change to the IRS rules. It kind of sneaks under the radar."

Then Francis reached for de Tocqueville, which is appropriate given that de Tocqueville wrote about the American democratic experiment and was himself French. The passage Francis cited is from "Democracy in America": tyranny won't look like a military government kicking down your door. It will be an ever-growing set of small rules that turn citizens into docile sheep.

Here in the United States, the Clarity Act is the current vehicle for the same slow creep. I've read the bill. The stablecoin issuers, the real-world asset token people, Coinbase, they're all cheerleading it because they want regulatory legitimacy for their casino operations. But buried in the bill are KYC/AML provisions with language vague enough that you could squint and apply them to open-source wallet developers, requiring some form of compliance when someone downloads a wallet. And on top of that, the bill extends the Patriot Act, which I believe should be repealed outright, not extended.

Everybody's cheering it on. The greed for regulatory legitimacy is overriding any concern for what these provisions will actually do to Bitcoin users' privacy and safety. Nobody on the pro-Bitcoin political side is pushing back on the KYC expansion. Nobody.

Francis's point, which he's put into practice in Canada, is that the answer is to say no and see what happens. Bull Bitcoin has multiple instances in Canada of the government requesting data, Bull invoking the Canadian Privacy Act, and the government backing down. It works more often than people expect.

I had my own version of that experience. 2012 or 2013, Missouri, I got funneled into a DUI checkpoint. The cop told me he needed to breathalyze me. I said no, that's not something you can do. He was pissed. He made me do a field sobriety test. I passed, because I wasn't drunk. But the point is that the pushback worked. The industry needs more of that. People need to develop the intestinal fortitude to know when to say no to the government and mean it.

Chain Analysis Is a Warrant Factory and the Industry Built It Themselves

Here's one of the most underreported scandals in Bitcoin: chain analysis was never legally mandated in any jurisdiction Francis is aware of. The industry invented it out of an inferiority complex, an overwhelming desire to signal to banks and regulators that crypto companies are just like you guys, they play by the rules, they're not sketchy. Exchanges started buying hundred-thousand-dollar-a-year subscriptions to chain analysis software and sending every Bitcoin address they touched to third-party surveillance companies. Nobody required this. They did it voluntarily.

And now, eight years later, if you're applying for a banking partnership and you can't name your chain analysis provider, they flag you as suspicious. An industry-invented custom is on its way to becoming law, because that's what customs do.

The consequences are severe. Roman Sterlingov, the man convicted in connection with the Bitcoin Fog mixer, is in prison. The case against him leaned heavily on chain analysis. When the defense sought to audit the chain analysis methodology, the answer was no. Black box, proprietary, you don't get access. Judges are treating these probabilistic PDFs as equivalent to fingerprints or DNA evidence.

Francis confirmed directly: "I can guarantee you that false positives are very bad. People are getting arrested with false positive chain analysis."

The technical foundation of chain analysis is weak. The most fundamental heuristic is the Common Input Ownership Heuristic, the assumption that every input in a transaction belongs to the same person. From that assumption, the entire analytical edifice is built. Francis explained that this assumption is false, and Pay Join breaks it explicitly. In a Pay Join transaction, inputs belong to both the sender and the recipient.

If enough transactions on the network are Pay Join transactions, you can mount a legal challenge to chain analysis as evidence, arguing it's based on a provably faulty premise.

Peter Todd published a report examining chain analysis methods in the context of Wasabi. Francis recounted that Todd, at a dinner, encountered a founder or VP of a chain analysis company who admitted privately, while drunk, that the product is "phony as hell," a pure larp. His words, via Francis, were that it's a warrant factory: if you want a warrant on anybody on earth, chain analysis will find a way to link their Bitcoin to a crime.

On top of all of this, exchanges are forcing address reuse because it makes their own chain analysis easier, creating a massive privacy failure and, Francis noted, a quantum risk exposure on every address where the public key has been revealed through spending.

The Cypherpunk Stack Has Never Been Stronger

I don't want to leave people in a dark place, because Francis and I are both genuinely bullish on what's being built, and he has the inside view to back it up.

Pay Join v1 is stable. The protocol has matured past the early alpha chaos where Sparrow, Cake Wallet, Blue Wallet, and Bull were all running incompatible versions. Now they're converging. Francis shared what he called breaking news as of our recording: Pay Join is now integrated not just in the Bull Wallet but in the Bull Bitcoin exchange itself.

It's experimental and not yet publicly announced, but every transaction between a Bull Wallet user and the Bull Exchange can now be a Pay Join transaction by default. Add Cake Wallet, which is also upgrading to the compatible version, and you're talking about tens or hundreds of thousands of Pay Join transactions that break the Common Input Ownership Heuristic at scale. Francis is also watching Boltz, the swap provider, as a potential high-impact integration.

Silent payments are the other major development Francis is excited about. The Bull Wallet silent payments pull request was opened the morning we recorded. The concept: a Bull Wallet user gives one silent payment address to the exchange forever, and the exchange generates fresh on-chain addresses on the fly from that static code. This directly attacks address reuse, which Francis calls the number one cause of Bitcoin privacy failures.

Beyond those two, there's the broader stack: Liquid swaps, Sparrow, Wasabi, Phoenix, Boltz, Aqua. Francis also mentioned a tool called Am I Exposed?, an open-source project that lets you run your own chain analysis to see what the chain analysis companies can see about you. And he mentioned a project called Octajoin by a developer called Floppy, a transactional privacy tool he's watching.

The AI and vibe coding advancement is real. Francis put it well: it reduces the asymmetry of power between the state and the individual. The NSA has 7,000 engineers and a data center. Individuals used to have essentially nothing on the self-defense side. Now cypherpunk builders can ship tools that five years ago would have required a $5 million VC raise and three years of runway. The pace of progress on the cypherpunk side is accelerating faster than the surveillance state can respond.

Francis has a Start9 node sitting next to his Starlink. Connecting a self-custodial wallet to your own Electrum server using silent payments and Pay Join on your phone and doing swaps is, in his words, a few clicks. The people saying the cypherpunk dream is dead are either uneducated or selling you something: a shitcoin or a financial product.

The absolute number of cypherpunk developers working on Bitcoin privacy is at an all-time high. The ratio to the NGU noise has shrunk. The absolute count hasn't.

What You Can Do

Francis and his team built a dedicated site at dac8.com that lays out the arguments for repealing DAC8 and explains the legal challenge in detail. Go read it. Share it. This is the kind of thing that needs to be known widely before the first mandatory reporting deadline hits on January 31, 2027.

Bull Bitcoin deliberately chose not to build a donation crowdfund or an industry coalition around this, partly to avoid the overhead and partly because they wanted to move without asking permission. So there's no donation page. The most direct thing you can do is download the Bull Wallet, use it, and leave an honest review on the app store. Francis said the team reads every review. It matters to them.

If you're serious about self-custody, which is the foundation of everything Francis and I talked about, Bitkey is the easiest on-ramp I've seen. No seed phrases, no single point of failure, two-of-three multisig with your device, the mobile app, and a key held by Block. The new model has a screen so you can actually verify what you're approving before you sign. Use code TFTC at bitkey.world for 10% off.

If you want institutional-grade collaborative multisig where you hold two of three keys, Unchained is the standard. They secure over $12 billion in Bitcoin for more than 12,000 clients. You trade from your vault, access Bitcoin-backed loans, set up IRAs with your own keys. Use code TFTC10 at unchained.com/tftc for 10% off a new vault.

About Francis Pouliot

Francis Pouliot is the founder and CEO of Bull Bitcoin, a Bitcoin-only, self-custody-first exchange operating in Canada, Europe, and Costa Rica. He has been building in the Bitcoin space since 2013, starting with a Bitcoin spending directory that evolved into what became Bull Bitcoin. He is an active contributor to Bitcoin privacy technology, including Pay Join (BIP77) and silent payments, and a longtime advocate for cypherpunk principles within regulated financial services. In February 2026, Bull Bitcoin filed a legal challenge against the French implementation of DAC8, the first known legal challenge to CARF implementation anywhere in the world.

Sources mentioned

• dac8.com: Bull Bitcoin's public site laying out the legal challenge and arguments against DAC8's French implementation
• OECD Crypto Asset Reporting Framework (CARF): the OECD primary documentation for the global framework behind DAC8
• Directive (EU) 2023/2226 (DAC8): the official EUR-Lex text of the EU directive that implements CARF and extends tax reporting to crypto-assets
• Regulation (EU) 2023/1114 (MiCA): the EU Markets in Crypto-Assets regulation under which Bull Bitcoin secured its license
• Bank Secrecy Act (IRS): the 1970 US law that established modern KYC/AML recordkeeping and reporting requirements
• BIP77 Pay Join specification: the technical standard for the Pay Join protocol Bull Bitcoin has integrated
• BIP352 Silent Payments: the specification for silent payments, which Bull Bitcoin is integrating into its wallet and exchange
• Common-input-ownership heuristic (Bitcoin Wiki): technical reference for the core chain-analysis assumption that Pay Join breaks
• Peter Todd, CoinJoin implementation analysis: technical writeup examining chain-analysis and deanonymization attacks on Wasabi and other CoinJoin schemes

Watch the conversation

Timestamps

• 0:00 - Intro
• 1:01 - What DAC8 Is and Where It Came From
• 5:31 - FATF, the Travel Rule, and How the Old KYC System Actually Worked
• 8:00 - France: Government Data Leaks and the Kidnapping Pipeline
• 12:55 - The Attack Surface Argument and Why We Should Be Going the Other Direction
• 13:47 - Bull Bitcoin's Legal Challenge: Grounds, Strategy, and Timeline
• 18:00 - CARF Coming to the US and Canada
• 22:00 - The COVID Bureaucratic Playbook Applied to Finance
• 30:00 - The Clarity Act, the Patriot Act, and the Industry Tightening Its Own Shackles
• 38:00 - Chain Analysis Is a Warrant Factory the Industry Built Itself
• 50:00 - Pay Join, Silent Payments, and the Cypherpunk Stack Right Now

Sponsors

• Bitkey: Bitcoin self-custody hardware with no seed phrases, two-of-three multisig, a full screen for transaction verification, and code delegation for inheritance and advanced recovery. Code TFTC for 10% off. bitkey.world
• Unchained: collaborative multisig custody and Bitcoin financial services. You hold two keys, they hold one. Over $12 billion secured for more than 12,000 clients. Trade from your vault, access Bitcoin-backed loans, open a Bitcoin IRA with your own keys. Code TFTC10 for 10% off a new multisig vault. unchained.com/tftc
• Aven: a Bitcoin-backed line of credit up to $1 million, no rehypothecation, custodied by BitGo, fixed rates from 7.99% APR for up to 10 years, 2% unlimited cash back. aven.com/bitcoin
• CrowdHealth: crowdfunded healthcare Marty's family has used for five years. As a family of five, roughly $700 a month. Code TFTC for $99 a month for the first three months. joincrowdhealth.com/tftc