Physical Risks
Families on the front line
DAC8 can expose spouses, children and relatives: physical risk does not stop with the account holder.
Updated
Short answer
A crypto data policy does not put only holders at stake. More than half of the violent incidents recorded in 2026 target a family member (spouse, child, elderly parent), as a direct victim or as a pressure lever. DAC8 therefore exposes not only crypto-asset holders, but their entire close family circle: between 40 and 135 million Europeans fall into a physical-risk zone, without any of them ever having consented.
Key facts
| Data point | Value |
|---|---|
| 2026 incidents involving a relative | More than 50% (direct victim or pressure lever) |
| Europeans in the physical-risk zone | 40 to 135 million (holders + relatives) |
| Family multiplier used | × 2.5 (average EU household size: 2.3 people, Eurostat 2023) |
| France | ~6.1M holders, or ~15M people exposed |
| 6 ADAN benchmark countries | ~37M holders, or ~90M people exposed |
| EU-27 (15% extrapolation) | ~54M holders, or ~135M people exposed |
| Relatives’ consent | None (never registered on a platform, no opt-out) |
More than half of this year’s incidents involve a family member (spouse, child, elderly parent) as either a direct victim or a pressure lever.
CertiK, Q1 2026 Wrench Attacks Report
The family risk
Documented extortion cases show that relatives can be targeted directly: elderly parents, spouses, children, business partners and employees. More than half of the incidents recorded in the first quarter of 2026 involve a family member, either as a direct victim or as a pressure lever (CertiK, Q1 2026 Wrench Attacks Report).
A crypto data leak does not expose only wealth. It exposes a social network. This radically changes the scope of the problem: the directive exposes not only crypto-asset holders themselves, but their entire close family circle.
No consent
A relative did not choose to use a crypto platform. They did not accept a CASP’s terms. They did not decide to enter a European crypto tax database. They agreed to no terms of service and have no opt-out.
Yet if their family link to a holder is easy to establish, they can become a target, and their life can be threatened because of another family member’s choices.
The multiplier effect
The number of people actually exposed must be multiplied by the close family circle. Every adult holder has, on average, at least 2 to 3 relatives who can be identified by criminals (parents, spouse, children), an assumption consistent with the average European household size (2.3 people in the EU per Eurostat 2023; French data INSEE 2022).
| Scope | Holders | Multiplier | People exposed |
|---|---|---|---|
| France | ~6.1M | × 2.5 | ~15 million |
| 6 ADAN benchmark countries | ~37M | × 2.5 | ~90 million |
| EU-27 (15% extrapolation) | ~54M | × 2.5 | ~135 million |
Methodology. The 2.5 multiplier is deliberately moderate. The low estimate (direct cohabitants only) is ~40M for the EU; the high estimate (full family circle) reaches ~135M. This turns tens of millions of holders into a much broader social risk.
Why targeting relatives changes everything
- A holder cannot protect them alone. Opsec does not protect an elderly parent living 500 km away, a child schooled in another region, or a separated spouse who still shares the family name.
- The risk is asymmetric. A leak of 50,000 Waltio holders becomes a leak of 125,000 people at real risk. A DAC8 leak (54M) would become a leak of 135M.
- Consent does not exist. Relatives never used a crypto platform, never signed any terms of service, and have no way to opt out; yet their lives are threatened because of a family member’s choices.
A tax measure, a physical risk
This is the central point: a tax measure can create a physical risk for people who are not crypto taxpayers. A proportionality analysis should therefore consider the people indirectly exposed by the data, not only the reportable user.
DAC8 creates structured, identity-linked crypto data. If it leaks, the harm extends to spouses, children, parents and business partners. That makes DAC8 a social-risk issue, not merely a tax-reporting issue.
Sources cited on this page: CertiK, Q1 2026 Wrench Attacks Report; ADAN, 2026 barometer; Eurostat EU-SILC 2023; INSEE 2022.