Data Security
Blockchain transparency
Why a blockchain address exposes more than an account number and makes mass collection disproportionate.
Updated
Short answer
A blockchain address is not a bank account number: it is an access key to an entire financial life that is public and permanent. Because it links a civil identity to a public, infinite ledger, DAC8 exposes far more than a single taxable event. The native transparency of public chains makes mass collection structurally disproportionate.
Key facts
| Feature | Bank account (DAC2) | Blockchain address (DAC8) |
|---|---|---|
| Information sent to the tax authority | Annual balances, interest | Identity (incl. home address) + crypto transactions and transfers, including operations with no tax relevance |
| Inferable in case of a leak | Balance on a given date | Identified holders (name, home address), cross-referenceable with the public on-chain history |
| Visible to third parties | None (except via the bank) | All of it, freely and permanently accessible |
| Counterparties | Impossible without a legal request | Identifiable through on-chain analysis |
| Historical data | Limited to retention rules | From the wallet’s origin, with no limit |
| Future data (post-leak) | Not affected | Visible in real time by the attacker |
A blockchain address is not a bank account number
The directive’s designers reasoned by analogy with DAC2 (the exchange of information on bank accounts). That analogy is misleading: a bank account and a blockchain address are not objects of the same nature.
On Bitcoin, Ethereum or nearly all public chains, every transaction is public, verifiable and permanent. Anyone, anywhere, can look up the complete history tied to an address (amounts, dates, counterparties) from its origin until the end of time. No authorization required, no procedure: just a web browser.
Banking data is stored inside closed institutional systems. Public blockchain data is visible by design: it is the link to an identity that shifts the risk profile.
A blockchain address is not a bank account number. It is an entire financial life laid bare.
A public, exploitable history
Amounts, dates, counterparties and movements can be analyzed by any observer. When an address is linked to a civil identity, the information changes in nature: it becomes an exploitable financial profile. An observer can then infer past activity, future activity, counterparties and wealth signals. This is precisely what makes mass collection of identity-linked crypto data unusually sensitive.
Collection captures everything, including what is not fiscal
Once a civil identity is linked to crypto activity on a public ledger, it becomes a key to the holder’s entire financial life. Beyond taxable disposals, the reporting captures:
- transfers between one’s own wallets (non-taxable);
- gifts to family members (non-taxable below allowance thresholds);
- donations to associations (tax-deductible);
- payments to merchants (non-taxable on the holder’s side);
- peer-to-peer (P2P) over-the-counter transactions between individuals;
- technical exchange operations (atomic swaps, conversions);
- withdrawals from personal mining or staking;
- every counterparty identifiable through on-chain analysis.
Future data, not only past data
A banking leak often exposes data as of a given date. A blockchain address leak, by contrast, can keep producing information for as long as the address stays in use or linked to other addresses. The exposure can therefore outlive the original reporting period. The user is then left to manage a complex operational risk in order to regain confidentiality.
The three consequences
- Risk to the taxpayer. A DAC8 leak does not expose a frozen “balance” but an open book that updates itself, in perpetuity: as long as the holder uses the known addresses, the attacker sees every operation live, with no way for the victim to undo it.
- No fiscal justification. The stated purpose (fighting fraud) only requires the taxable operations. DAC8 collects everything, when it would need very little.
- Breach of proportionality. Article 52 of the Charter of Fundamental Rights requires that any limitation of a right be necessary and proportionate. The CJEU recalled this in its case law on FATCA and the GDPR.
A structural disproportion
To calculate tax, the administration does not need unlimited exposure of a taxpayer’s on-chain life. It needs relevant, targeted and proportionate information. The real proportionality question is therefore not just how many fields are collected: it is what those fields unlock once combined with public ledgers and blockchain analytics tools. DAC8 tends to collect more than what is strictly necessary for the tax objective.