TheBlock
Hackers broke into France's General Directorate of Public Finances sometime in late June and extracted taxpayer records for roughly 678,437 people, including nearly 27,000 with annual incomes above €100,000, 386 above €1 million, and eight above €10 million. The attacker, operating under the moniker ZeroBytes, claimed to have used an internal search tool to pull the records before being cut off, and the database is now reportedly for sale on dark web marketplaces for several thousand euros. France's Finance Minister confirmed the intrusion, though the exact scope is still under investigation.
Why it matters
The stolen fields, including names, birthdates, home addresses, phone numbers and email addresses, do not explicitly flag who owns crypto, but they hand criminals a near-perfect list of wealthy French households to cross-reference against on-chain activity, social media footprints or older leaks. Bitcoin security researcher Jameson Lopp, who maintains one of the longest-running public databases of physical crypto attacks, summed up the read on X with: "More bad news for Bitcoiners living in the leading country for wrench attacks." France is already the global epicenter of so-called wrench attacks, where criminals use violence or coercion to extract wallet credentials. Chainalysis recorded 30 publicly known violent crypto attacks in France in just the first half of 2026, lifting over $30 million and putting this year on pace to top the $58 million stolen in 2025.
Market impact
The breach compounds a parallel problem: a French tax employee was arrested in June 2025 for allegedly selling crypto investors' confidential information to criminal organizations, and Chainalysis has linked that case directly to the wave of physical attacks. Recent incidents underline how persistent the risk is even after data goes stale. Earlier this week, a couple in France's Somme department were targeted three times in less than a month after moving into a house previously occupied by crypto millionaires whose tax data and address had appeared on the dark web. Hardware-wallet buyers are also exposed through third-party supply chains.
Frequently asked questions
-
How many people were exposed in the French tax breach?
Roughly 678,437 taxpayers were affected, including nearly 27,000 with annual incomes above €100,000, 386 above €1 million, and eight above €10 million.
-
Who is behind the breach?
An attacker using the moniker ZeroBytes claimed to have accessed an internal search tool at France's General Directorate of Public Finances and extracted the records before being cut off.
-
Why is this breach especially dangerous for crypto holders?
The stolen records include names, addresses, phone numbers and emails but do not flag crypto ownership, giving criminals a wealthy-target directory to cross-reference against on-chain activity and older leaks.
-
How bad are wrench attacks in France right now?
Chainalysis recorded 30 publicly known violent crypto attacks in France in the first half of 2026, lifting over $30 million, putting the year on pace to surpass 2025's record of $58 million.
-
Did Trezor customers get hit too?
Trezor disclosed Wednesday that a breach at its ShipMonk shipping provider exposed records for nearly 14,000 hardware wallet customers, including phone numbers and addresses for 11,742 of them.
CryptoSlate
CoinTelegraph
CoinDesk
WuBlockchain