Hacking: Belgium demands crypto addresses of illegal sites

On August 19, 2026, the Belgian Department for Combating Online Infringements (BAPO) issued five decisions requiring four registrars and a register to transmit a complete file on the operators of illicit sports streaming sites: identity, IBAN, bank cards, crypto wallets and transaction identifiers, plus twelve months of connection logs. All under the seal of secrecy. The extra-border scope of the injunction remains, in practice, to be tested.

Belgium tracks pirates via registrars’ crypto wallets

The traceability of European crypto players remains at the heart of the debates. The Belgian injunction follows this same logic, but via another link: the registrars. The five decisions result from an order from the French-speaking Business Court of Brussels, seized at the end of July 2026.

Four requests were sent to domain registrars. The fifth concerns a domain name registry.

Three companies appear in the documents made public : Hosting Concepts, a company linked to Openprovider, Hostinger and Key-Systems. They are all established in the European Union, but outside Belgium.

The name of a fourth registrar as well as that of the register concerned have been hidden. The authorities have also not revealed the domain names targeted by the procedure. The Court, however, found that the requests made were proportionate.

There is a lot of information requested. In particular, the BAPO wants to obtain the full identity of the account holders, as well as the history of their postal addresses, email addresses and telephone numbers.

The authorities also ask for available bank details, including IBANs and the exact identity of the account holder. Data linked to payment cards are also affected: BIN, last four digits, issuing bank and country of issue.

The most unusual part concerns crypto payments. Registrars must communicate any crypto payment methods used by their clients, including wallet addresses, the type of asset concerned and the hash of the transactions.

Finally, decisions also require detailed technical informationincluding IP addresses, device type, operating system and browser used. Up to twelve months of connection logs can be requested, with very precisely time-stamped data.

Why extra-border reach is not guaranteed

The injunctions are based on Article 10 of the Digital Services Act, which is supposed to govern the application of an “information order” to a service provider established elsewhere in the Union. The problem is that the BAPO is a Belgian federal service, while not all of the registrars concerned are.

Nothing therefore prevents a Dutch, Lithuanian or German registrar from contesting the transmission in the name of its national law or the GDPR, or even bringing the matter before the Court of Justice of the European Union.

Added to this first fragility is the secrecy imposed by the gag order: the BAPO invokes the exception linked to criminal investigations to free itself from the duty of information provided for by the DSA. Concretely, an operator can see his identity, his banking history and his logs transmitted to the rights holders without being notified.

For an operator having billed its service in stablecoins or bitcoin, this injunction transforms the registrar into a gateway to its on-chain identification. A wallet in itself is just a public address.

However, associated with the transaction hash, then cross-referenced with twelve months of IP logs, it gives rights holders a procedural starting point to request the lifting of anonymity from European exchanges, already subject to Travel Rule and KYC rules.

The short-term test will be simple to observe: Will Hostinger, Hosting Concepts and Key-Systems transmit the data, contest the injunction, or request a stay? If one of the three seizes the CJEU, this Belgian case will become a textbook case on the extra-border enforceability of Article 10 of the DSA. This type of index aggregation has already produced its effects in the past, as shown by the Movie2K affair documented by Tremplin.io.