Every crypto customer is now reported. We are fighting back.
The EU directive DAC8 requires exchanges, brokers and apps to tell the tax office every year who you are and how much you traded, without any suspicion.
Then you are affected.
- To the tax office: every year your name, home address, date of birth, tax identification number and tax residence, and per crypto-asset the yearly totals of what you bought, sold, exchanged and transferred. Transfers to your own wallet, where only you hold the keys, appear as a total, without the wallet address.
- With the provider: your ID, wallet addresses and individual transactions. Anti-money-laundering rules currently require it to keep them for up to ten years after you leave.
- When: providers in Austria send the first report by 31 July 2027. If you live in Germany or another EU state, it goes on to the tax authority there by 30 September 2027.
Then DAC8 does not report you.
- This holds as long as you never buy or sell through an exchange, broker or app.
- If you do buy there and move the bitcoin to your own wallet, the value of those transfers usually appears in the provider’s annual report as a total, without the wallet address.
- If you were a customer of a provider in 2020 or later, anti-money-laundering rules currently require it to keep your ID, wallet addresses and transactions for up to ten years after you left.
It depends on where you buy.
- Exchanges, brokers and apps where you buy crypto-assets or leave them in safekeeping count as providers, including banks that offer crypto.
- Your provider has to tell you before it reports for the first time.
What happens to your data
Max is invented, the cases are real.
Your data ends up in more and more places.
Exchange: ID and trades. Wallet maker: delivery address when you order a device. Tax tool: data from multiple exchanges and wallets. And they pass data on, to places you never chose.
From 2027, the exchange reports you automatically every year.
To the tax office, without wallet addresses. The exchange must delete the reported data ten years after the calendar year it covers. Other customer records may remain longer.
Without wallet addresses. Reported data: deleted after ten years. Other customer records may remain longer.
Stored, hacked and sold.
Exchanges, tax tools, wallet makers and tax administrations have lost such data before. After a data leak nothing is missing, but your data is in strangers’ hands for good.
After a data leak your data is in strangers’ hands for good.
The data becomes a target list.
Ranked by holdings, with home addresses.
Your profile becomes a target.
Bitcoin in your own wallet is like cash at home: your business.
Like cash at home: nobody should know who holds how much.
Max is invented, the cases are real.
Coinbase · Exchange · 2025
Defrauded with real customer data.
Bribed support staff copied customer data, down to ID images and balances. Fraudsters then posed as Coinbase and persuaded customers to send them money. Coinbase estimates the costs, including reimbursements, at 180 to 400 million dollars. Phishing in Coinbase’s name then also rose in Austria.
All data leaks with sourcesWaltio · Crypto tax service · 2026
Tax data as a target list.
At the French crypto tax service, customers’ email addresses, gains and losses and year-end balances fell into the wrong hands. According to the French police, criminals use the data to select victims of violent crime, sometimes misjudging what they actually hold.
All data leaks with sourcesLedger · Hardware wallet shop · 2020
The home addresses of 272,000 wallet buyers.
Names, postal addresses and phone numbers leaked from the hardware wallet maker’s online shop. Phishing emails and text messages followed, asking for the recovery phrase. In a University of Innsbruck survey, 93 of 104 affected customers reported scam attempts and 33 reported extortion threats.
All data leaks with sourcesFrance · Tax administration · 2026
The tax administration is breached twice.
Using officials’ stolen credentials, attackers extracted 1.2 million records from the national bank-account register in February, with IBAN, name and postal address. In the summer, data on income, postal address and property on 678,000 individuals and businesses followed from the tax system.
All data leaks with sourcesThe danger begins when people know who holds how much.
Exchanges, tax tools and authorities have already lost such data, on about 46 million people across the documented cases. In the EU, 64 attacks on crypto holders have become known so far in 2026, against 45 in all of 2025.
This is about more than tax.
-
We defend self-custody.
Holding bitcoin with your own keys is as normal as cash at home.
-
Private until a leak supplies the names.
The blockchain is public, but it shows no names. Once a leak ties yours to your wallet addresses, your past payments are tied to you too.
-
Privacy concerns everyone.
Even small payments can show whom you donate to and whom you support.
First interest, then accounts. Now crypto.
What the tax office learns automatically about private individuals has grown since 2005. Crypto-asset providers now report their domestic customers too, and the next expansion is already proposed.
- Interest from abroad
- Pay, pensions, property abroad
- Accounts abroad, with balances
- Banks’ ID and customer records
- Income through online platforms
- Your crypto-assets, at home too
- Access to registers, incl. property and pensions, planned from 2028
We are taking DAC8 to court.
In October 2026, attorney Dr Oliver Völkel (CERHA HEMPEL) filed a complaint as a customer of a provider. We are convinced that collecting data on every customer without suspicion violates fundamental rights.
- Provider
- Data Protection Authority Now
- Federal Administrative Court
- Constitutional Court / CJEU This is where data retention fell in 2014.
In the media
-
Blocktrainer
ANWALT KLAGT gegen EU-BITCOIN-ÜBERWACHUNG! 💥 Wird DAC8 jetzt gekippt?
With Dr. Oliver Völkel
-
-
An initiative by Bitcoin Austria, a nonprofit association from Vienna Where the case stands