The EU is compiling registries of crypto holders (DAC8, live since January). France already shows the failure mode: a tax office clerk sold investor data to kidnapping gangs

Since January 1, 2026, every crypto exchange and broker serving EU residents has been collecting, for tax authorities, a file on each client: name, home address, date and place of birth, tax numbers, and aggregate yearly values of everything bought, sold, and swapped. Transfers to addresses the platform does not recognize are reported too, which in practice flags withdrawals to self-custody. In 2027 these files start flowing between the tax administrations of all 27 member states.

The fiscal purpose is legitimate and the data is not public. That is precisely why the honest question is not whether the system is sealed on paper but how comparable datasets have actually escaped. The record is complete: a hacked private provider (Ledger 2020, 270,000 customers with home addresses), a bribed insider at a support contractor (Coinbase 2025, about 70,000 users including KYC document scans, with bribes reportedly starting in the hundreds of dollars), a corrupt official (a clerk at a French tax office, in custody since June 2025, allegedly ran queries for crypto investors and sold the results to organized crime), and a breached crypto tax platform (Waltio, January 2026, database on the dark web). In 2019 Bulgaria leaked the tax records of nearly every adult in the country.

The stakes differ from ordinary financial data. A bank balance is a claim on an institution, protected by reversals and AML holds; self-custodied crypto is a bearer asset, seized together with the person. Knowing someone's deposit helps a fraudster; knowing someone's hardware wallet helps a kidnapper. The CJEU understood this in 2022 when it struck down public beneficial-ownership registers, listing fraud, kidnapping, blackmail, extortion, harassment, and violence as the risks of exposing wealth data.

What proportionate design would look like: strict data minimization, logged and audited access per official, serious criminal exposure for misuse, independent audits of the exchange systems. What individuals can lawfully do meanwhile: shrink the KYC surface to one provider, never ship wallet hardware to a home address, and structure custody so that leaked knowledge is useless to an attacker.