French tax breach exposes nearly 678,000 people as crypto wrench attacks pile up

Hackers stole French taxpayer data in a cyberattack that reportedly exposed around 678,000 people, including hundreds reporting income above €1 million (roughly $1.16 million), potentially creating an updated target list for criminals in a country already dealing with a surging number of violent crypto attacks.

France's Finance Minister confirmed that a hacker broke into the General Directorate of Public Finances sometime in late June and extracted data belonging to individual and professional taxpayers.

FrenchBreaches, a platform tracking cyberattacks in the country, reports that 678,437 people were affected. This is equivalent to roughly 1% of France's population, though an investigation is still underway and the exact number has not been confirmed.

Among those affected, nearly 27,000 had tax income of at least €100,000, while 386 reported more than €1 million and eight were over €10 million. The stolen database is reportedly for sale on dark web marketplaces for several thousand euros.

The data reportedly contains sensitive information like names, birthdates, home addresses, phone numbers and email addresses.

The attacker, who goes by the moniker ZeroBytes, claims to have accessed an internal search tool to extract the records before being discovered and cut off.

A wave of violent attacks

The breach does not appear to specifically identify which taxpayers own crypto. The combination of income information and identities could help criminals identify wealthy targets for fraud, home invasions, or kidnappings.

"More bad news for Bitcoiners living in the leading country for wrench attacks," Bitcoin security researcher Jameson Lopp wrote on X in response to the breach. Lopp has compiled and maintained one of the most extensive public databases of physical attacks targeting crypto holders, going back nearly 12 years.

In the past couple of years, France has emerged as one of the worst global hotspots for these so-called wrench attacks, where criminals use violence or threats to force victims to give up access to their crypto.

Blockchain data platform Chainalysis recorded 30 publicly known violent crypto attacks in France, robbing crypto holders of over $30 million in just the first half of 2026. That puts this year on pace to surpass the record $58 million stolen in 2025.

The analytics firm linked the trend in part to a separate case involving a French tax employee accused of selling crypto investors’ confidential information to criminal organizations beginning before her June 2025 arrest.

Recent incidents show just how dangerous this information can be if it gets into the wrong hands, even after becoming outdated. Earlier this week, reports circulated of a couple in France's Somme department (roughly the equivalent of a province or county), who were targeted three times in less than a month after moving into a house formerly occupied by crypto millionaires whose tax information and address appeared on the dark web.

Hardware wallet customers are also finding their personal information exposed through third-party breaches. Trezor disclosed on Wednesday that a breach at its ShipMonk shipping provider compromised information belonging to nearly 14,000 customers, including phone numbers and addresses of 11,742 people.