France tax breach puts wealthy Bitcoin holders at risk

A hacker is marketing tax details involving over 678,000 French individuals and companies, exposing a treasure trove of personal and financial data that could be used for phishing, identity theft, and targeting Bitcoin holders.

Chainalysis estimates that criminals earned a minimum of $17 billion from crypto scams and fraud in 2025, with impersonation scams increasing in size by more than 1,400% over the same year. Using identifiable information like names, addresses, and income figures can make a generic scam seem legitimate enough to appear as if it comes from a bank, exchange, tax office or police department.

What the hacker is selling

French cybersecurity outlet FrenchBreaches, which first reported the sale, said the data came from France’s tax authority, the DGFiP. The outlet said the file covers 392,867 individuals and 285,570 professionals. A sample included names, addresses, phone numbers, income figures, and family information.

The sample appeared to indicate potential targets. FrenchBreaches noted a total of 26,805 individuals with a reported reference income of at least $116,000, 386 with a reference income of more than $1.16 million, and eight with a reference income exceeding $11.6 million.

France’s Finance Ministry has acknowledged that there was a hacking incident, divulging that the hackers employed stolen VPN credentials to be able to access one of the agency’s internal search tools towards the end of June. The hackers’ access to the system was only cut during a “routine check” of the system, but the data theft was not uncovered. According to Reuters, this incident affected 678,000 users, and there would be personal notifications sent soon. However, the full scale of the incident is still being established.

Why Bitcoin holders are the sharp end

Bitcoin security advocate Jameson Lopp warned that the breach was particularly concerning in France, which he described as the leading country for “wrench attacks,” noting that the leaked dataset included 26,805 people earning more than €100,000 and 386 earning more than €1 million. Lopp had already raised concerns about France’s crypto-targeting problem in January 2026, when he commented on a separate case involving a French tax official allegedly using privileged access to identify cryptocurrency owners. Now, a DGFiP breach has exposed detailed taxpayer information. The two incidents should not be portrayed as connected, but the security concern is clearly related.

More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked and 678K records leaked.

26,805 people with income over 100K€
386 people with income over 1M€
8 people with income over 10M€https://t.co/KlT0XqPLFR

— Jameson Lopp (@lopp) August 14, 2026

CertiK’s data corroborates Lopp’s statement. The blockchain security company recorded 52 cases of verified wrench attacks globally in the first half of 2026, of which 33 took place in France. As such, France represents 63.5% of CertiK’s dataset, making it the largest national hub. According to CertiK, factors leading to the high concentration of wrench attacks in France include the country’s sizable crypto industry, notorious business leaders, publicly displayed extravagance, and the incidence of sensitive data breaches.

Because of this, the leak is bigger than just a privacy violation. A comprehensive database can help criminals skip the reconnaissance that they would need to do on their own: names tell them whom they are dealing with, an address reveals to them where to look, and the income information lets them know whether the target is worth pursuing.

CertiK refers to this process as “data-driven targeting“, and it means combining leaked information with social media, blockchain activity, and public information.

France has learned what it means to experience a transition of crypto-crime from the digital sphere into physical reality. Cybermalveillance.gouv.fr has reported on fraudsters who pretend to be employees of crypto platforms, banking fraud teams, and law enforcement bodies to convince people to remit funds or give away sensitive data. Law enforcement agencies have faced cases of threats, physical abuse, and abductions.

However, just having security features in place is not enough. Holders of high-value assets can reduce their exposure by avoiding publicly disclosing personal details, splitting important funds among various wallets, using multiple signatures, and storing sensitive recovery data in secure places. Any person whose information may have been involved in a breach must expect that any future fraud attempt will involve accurate details about them and, thus, can be very convincing.

A pattern regulators are chasing

The breach comes as France faces wider data-security problems. CNIL, France’s data protection authority, has made cybersecurity a major enforcement priority for 2026.

However, regulatory measures cannot erase any information after it has already been duplicated and sold. This is particularly important for users of cryptocurrencies because once cryptocurrencies have been transacted, there is no turning back.

ADAN reports that about 11% of people in France own cryptocurrencies, which represents a huge group of possible victims.

The leak does not imply that all holders of cryptocurrency in France face a physical risk or that hackers will use the information to carry out a direct attack. But CertiK’s statistics explain why the leak is quite sensitive.

With respect to the taxpayers who may be impacted by the breach, their best alternative would be to exhibit scepticism towards any unexpected phone calls, e-mail messages and texts, regardless of how much personal information the sender may have. Never give out any passwords, recovery phrases or private keys, and open the website or app of the relevant organization, not using the links or contact information from the unsolicited message.

The lesson is simple: personal data is part of the attack surface. In crypto, where trust can be the final barrier before an irreversible transaction, stolen information can become the tool that makes a scam believable — or helps a criminal decide whom to target.

The smartest crypto minds already read our newsletter. Want in? Join them.