Bitcoiners have been warned after France’s tax administration confirmed that hackers breached its information system, exposing sensitive financial and personal data belonging to hundreds of thousands of taxpayers and businesses.
Writing on X on Friday, Bitcoin developer Jameson Lopp said the leak was “more bad news for Bitcoiners living in the leading country for wrench attacks.”
Lopp has created a tracker counting wrench attacks — when physical violence is used to steal crypto — across the world. A large amount happens in France, where data has been leaked before.
The news comes one day after hardware wallet manufacturer Trezor announced a data breach exposing customer data.
Cybersecurity researchers at FrenchBreaches, who reviewed samples of the leaked data, reported that the affected records break down to roughly 392,867 individuals and 285,570 businesses.
Among the individuals, an estimated 26,805 have a reported annual taxable income of €100,000 or more, 386 exceed €1 million, and eight exceed €10 million. The hacker is said to be offering the full dataset for sale for several thousand euros.
The breach first surfaced publicly on August 12, when a hacker using the alias “ZeroBytes” posted on a cybercrime forum claiming to have infiltrated internal DGFiP servers and obtained VPN credentials that unlocked an internal lookup tool covering millions of taxpayers.
According to the hacker’s own account, the extraction was interrupted before it could be completed, leaving what they described as only a partial dataset of 678,438 records.
The exposed sample reportedly includes highly sensitive information: full legal names, dates and places of birth, home and mailing addresses, marital status, number of dependents, internal tax identification numbers, reference taxable income, individual withholding tax rates, phone numbers, email addresses, and records of past correspondence with tax officials.
Security analysts warn that this combination of identity, contact and financial data could fuel highly convincing phishing campaigns impersonating tax authorities, as well as identity theft and fraud schemes tailored to victims’ income levels or family circumstances.
2025 was the worst on record for wrench attacks (crypto targeted kidnappings), with around 55 reported globally last year, according to TRM Labs. Lopp’s tool counted over 70 throughout last year. And this year is already looking bad, according to the tracker: 54 attacks have been documented so far.
Wrench attacks made headlines last year when crooks kidnapped David Balland, co-founder of crypto hardware wallet brand Ledger, and his wife in France.
Criminals held the pair for around 24 hours before they were rescued by the French authorities.