Starting Situation

Berlin, Romania, France: Within a few weeks, three extraordinarily "successful" large-scale attacks show what happens when central databases are hacked by third parties. And the EU is building an even larger data pool with the most sensitive data of citizens.

 

- Berlin (August 2026):

5.8 TB of government data stolen, 1.44 million files, 30 BTC ransom

- Romania (July 2026):

Entire land registry database deleted → real estate market frozen nationwide

- France (2026):

77 physical attacks on crypto holders (leaked KYC data = know your customer)

 

EU – Objective

DAC8 (EU Directive 2023/2226) obliges all crypto exchanges from 2026 to report the name + address + Bitcoin holdings of the natural persons and legal entities registered there – an automatic exchange takes place between the 27 EU states.

The problem: This database answers exactly the question that hackers (and their customers) are most interested in: Who owns something transferable, and where do they live?

 

Is there already resistance?

Yes, the company (an exchange) Bull Bitcoin is suing in France.

On 24 February 2026, Bull Bitcoin filed a lawsuit with the Conseil d'État (France's highest administrative court). Goal: have DAC8 declared unconstitutional and bring it before the ECJ (Art. 267 TFEU).

 

What happens in the event of such a lawsuit succeeding?

Should this case reach the ECJ, it could overturn the DAC8 Directive; with effect for all 27 EU states.

Is that realistic?

We say: yes. There are indeed precedents: In 2022, the ECJ already declared the DAC6 Directive (predecessor directive) invalid due to a fundamental rights violation (Art. 7 EU Charter of Fundamental Rights).

Do we have to and want to rely here in Germany on Bull Bitcoin (alone) getting through? We think: no, we won't do that.

We therefore want to go before the Federal Constitutional Court; the appropriate remedy is the constitutional complaint (VB).

 

So what is the plan?

File a lawsuit in parallel to Bull Bitcoin.

If (also) a German court refers the question to the ECJ, the DAC8 Directive could also be overturned EU-wide.

Persons (natural and legal) who believe they are affected can contact us and join the VB – more on that below.

 

Why do we think the DAC8 Directive is unconstitutional?

1. Mass surveillance without suspicion

Every exchange user is captured – without concrete cause. This violates the Census ruling (BVerfG 1983): data collection only with concrete cause.

 

2. Not necessary / completely oversized

We already have a norm that can collect data ON SUSPICION. § 93 AO already gives tax authorities the right to demand targeted information from exchanges ON SUSPICION.

A mass database is disproportionate.

 

3. The harm outweighs the benefit

Well, here one must already ask whether the state considers it (its) harm when the data is hacked!? Berlin's mayor only says: "we won't be blackmailed". Fine and good. But what about the citizen / the exchange / the affected person?

Does the legislator ask whether the hack itself is harm if it's (only) about citizens' data? A look at the Directive / the law can help answer this question.

Neither in the Directive nor in the German implementing law are there any liability provisions OBLIGING THE STATE.

Well, what else is there? General state liability provisions (Art. 34 GG, § 839 BGB)… That already sounds complicated and it is. The affected person must prove fault on the part of the state; the burden of proof for a failure of the state lies with the affected person! And the courts will certainly not accept the reference to the hack as sufficient (in the sense of: hack = failure).

We here assume that already the leak / the publication of the data on the internet (which also includes the TOR network and the like) constitutes harm for the affected person.

 

Can the state provide absolute IT security at all?

And nothing less must be demanded of it if it creates legal facts in this way.

We think: no, he can´t.

Unfortunately, we now have countless pieces of evidence: – Berlin: 5.8 TB leaked; – Romania: land registry database deleted, the entire land registry system has collapsed nationwide; – France: 77 attacks on holders, and so on and so forth.

 

ECJ precedent: DAC6 was overturned

In 2022, the ECJ declared a provision of DAC6 invalid (Orde van Vlaamse Balies) – due to a fundamental rights violation. In our view, the DAC8 Directive has the same structural problems.

 

What do we rely on, i.e. what legal basis does the VB rest on?

- Art. 2(1) GG (right to informational self-determination)

- Art. 8 ECHR (private life)

- Art. 7+8 EU Charter of Fundamental Rights

- Art. 12 GG (freedom of occupation) – for the exchanges affected by the Directive

 

Who can join the VB and how, and what costs are involved?

 

There are two ways.

WAY 1, which we prefer:

10 slots through named applicants

(yes, we are aware that it could be difficult for private individuals to appear as applicants, since – in the event of success – their names would with high probability appear in the decision databases. For legal entities, such as an exchange, that should hardly be a problem.)

- Private individuals: € 1.000 up to €1,500 = 1 slot (requirements: German residence, KYC exchange customer, willingness to appear by name. depending on the number of clients, RVG-compliant)

- Exchanges:

  - Small exchange (< 10 employees): €4,500 = 3 slots

  - Medium-sized exchange (10-50 employees): €7,500 = 5 slots

  - Large exchange (> 50 employees): €12,000 = 8 slots

 

Considerations that could motivate exchanges to join the VB:

- Compliance costs: €100,000–500,000/year

- Fine risk: up to €50,000 (§ 18 KStTG)

- Art. 12 GG (freedom of occupation) + Art. 2 GG (data protection) = double fundamental rights violation

- On success, these DAC8 costs fall away → ROI within weeks

 

WAY 2 (as fallback): founding an association

If Way 1 fails, an association would/could have to be founded. The members would remain anonymous; only the association appears as applicant.

The disadvantage: time-consuming and additional costs and dependencies arise.

 

7. Timeline & deadlines

At the end of September 2026, we will decide whether sufficient interest exists for this project.

Until then, interested parties can contact us:

 

Contact:

- KeyChat: npub1rawahl0g933pffpwyznejmg7z9xcgry7uu9x776kfy97pvxl2a2s657hck

- Email: info@wahl-kanzlei.de (subject: "DAC8-VB Börse")

- https://www.wahl-kanzlei.de/kontakt.html

 

Why do we set this deadline?

The VB must be submitted by us to the BVerfG no later than 24 December 2026, since there is a deadline of one year from the entry into force of the German implementing law (KStTG).

When can a decision by the BVerfG be expected? Realistically, approx. 18 months should be assumed.

 

8. Chances of success of a VB - what the stats are telling us?

This is part of the truth:

Statistics state that at the BVerfG only approx. 2.5% of all VBs (standard statistics) succeed.

 

If our VB is accepted by the BVerfG and ruled upon positively, then a referral to the ECJ is, in our assessment, realistic (with approx. 30–40%).

Then – as described – Bull Bitcoin + the German applicants would proceed in parallel.

 

Why are we optimistic (if it hasn't become clear so far):

There is a strong precedent: the ECJ overturned the DAC6 Directive in 2022. And the DAC8 Directive at issue here is structurally identical.

 

This post is not legal advice.

Joining the VB is the result of your decision. No client relationship (mandate) comes into being without a written contract / power of attorney.

 

Michael Wahl

lawyer