A hacker is offering for sale a stolen database covering 678,437 records from France’s tax authority, the DGFiP, following a breach in late June that security researchers say could sharpen an already worsening wave of physical attacks against Bitcoin holders. According to research group FrenchBreaches, the intruder used stolen VPN credentials paired with an internal search tool to extract taxpayer data before access was cut off.
The exposed data spans 392,867 individuals and 285,570 professionals, and includes names, birth details, home addresses, email addresses, phone numbers, income figures, withholding tax rates, family status and dependent information. Within the file, 26,805 people are listed with taxable income of at least $116,000, 386 with income above $1.16 million, and 8 people with income exceeding $11.6 million — a level of granularity that lets a buyer filter directly for the wealthiest, most identifiable targets. The hacker is reportedly asking several thousand dollars for the complete file.
Why Bitcoiners Are Especially Exposed
Casa Chief Security Officer Jameson Lopp, a longtime tracker of physical crypto crime, reacted to the breach directly:
More bad news for Bitcoiners living in the leading country for wrench attacks.
Security researchers note that combining verified income data with home addresses and family details lets criminals craft fraudulent outreach that is far more convincing than a generic phishing email — messages that can reference real income figures or family members to pressure a target into revealing crypto holdings or granting physical access.
France’s Wrench-Attack Problem Was Already Escalating
Chainalysis data published earlier this year shows 46 documented violent crypto attacks worldwide through June 2026, with more than $30 million stolen — a pace that would top 2025’s full-year record of $58 million if it continues. France accounted for 30 of those incidents, the largest concentration of any country, and relatives of the primary target were involved in more than 40% of French cases, well above the roughly 25-30% share seen globally. Home invasions also grew sharply as a share of all incidents, rising to 37% of 2026 cases from 14% in 2025, while kidnappings accounted for 52%.
Related: MSCI Revives Proposal to Drop Strategy From Global Indexes
Not every attack succeeds: Chainalysis found only 12 of the 46 documented 2026 incidents resulted in an actual payment, putting attackers’ overall success rate at roughly 26%. But the firm also found that in France, 93% of victims were local residents rather than tourists or visitors, indicating that most attacks are planned in advance against known targets rather than opportunistic — precisely the kind of planning a leaked income and address database would make easier.
Security researchers are urging French Bitcoin holders to review their operational security in light of the leak, including scrutinizing unsolicited contact that references specific financial details and reconsidering how much wealth information is visible or inferable from public records and social media.
