Hacking: Belgium demands crypto addresses from illegal sites

On August 19, 2026, the Belgian Department for the Fight Against Online Offenses (BAPO) issued five decisions requiring four registrars and one registry to provide a complete file on operators of illegal sports streaming sites: identity, IBAN, credit cards, crypto wallets, and transaction identifiers, plus twelve months of connection logs. All of this is under a confidentiality seal. The extraterritorial scope of the injunction remains, in practice, to be tested.

In brief

• Five decisions from the Belgian BAPO (August 19, 2026) require registrars and a registry to transmit identities, IBANs, cards, and crypto wallets.
• Three European registrars are named: Hostinger, Hosting Concepts/Openprovider, and Key-Systems.
• Basis: Article 10 of the Digital Services Act, with an exception to the duty of information.

Belgium tracks pirates via crypto wallets of registrars

The traceability of European crypto actors remains at the heart of the debates. The Belgian injunction fits into this same logic, but through another link: the registrars. The five decisions stem from an order from the Francophone Commercial Court of Brussels, seized at the end of July 2026.

Four requests were addressed to domain registration offices. The fifth concerns a domain name registry.

Three companies appear in the publicly released documents: Hosting Concepts, a company linked to Openprovider, Hostinger, and Key-Systems. They are all established in the European Union, but outside of Belgium.

The name of a fourth registrar and that of the concerned registry have been redacted. The authorities have also not revealed the domain names targeted by the procedure. However, the Court deemed that the requests made were proportionate.

The requested information is extensive. The BAPO particularly wants to obtain the complete identity of account holders, as well as the history of their postal addresses, email addresses, and phone numbers.

The authorities also request available banking details, including IBANs and the exact identity of the account holder. Data related to payment cards is also included: BIN, last four digits, issuing bank, and country of issuance.

The most unusual part concerns crypto payments. Registrars must communicate any crypto payment methods used by their clients, including wallet addresses, the type of asset involved, and the transaction hashes.

Finally, the decisions also demand detailed technical information, including IP addresses, device type, operating system, and browser used. Up to twelve months of connection logs may be requested, with very precise timestamped data.

Why the extraterritorial scope is not guaranteed

The injunctions rely on Article 10 of the Digital Services Act, intended to regulate the application of an "information order" to a provider established elsewhere in the Union. The problem is that the BAPO is a Belgian federal service, while the targeted registrars are not all.

Nothing prevents a Dutch, Lithuanian, or German registrar from contesting the transmission in the name of its national law or GDPR, or even bringing the case before the Court of Justice of the European Union.

To this initial fragility is added the secrecy imposed by the gag order: the BAPO invokes the exception related to criminal investigations to free itself from the duty of information provided by the DSA. In practice, an operator may have their identity, banking history, and logs transmitted to rights holders without being notified.

For an operator who charged for their service in stablecoins or bitcoin, this injunction transforms the registrar into a gateway to their on-chain identification. A wallet is merely a public address.

However, when associated with the transaction hash and then cross-referenced with twelve months of IP logs, it gives rights holders a procedural starting point to request the lifting of anonymity from European exchanges, which are already subject to Travel Rule and KYC regulations.

The short-term test will be easy to observe: Will Hostinger, Hosting Concepts, and Key-Systems transmit the data, contest the injunction, or request a stay? If one of the three brings the case to the CJEU, this Belgian case will become a landmark case on the extraterritorial applicability of Article 10 of the DSA. This type of aggregation of evidence has already produced effects in the past, as shown by the Movie2K case documented by Cointribune.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.