French tax data breach exposes 678,000 people, fueling crypto ‘wrench attack’ fears

678,437 French taxpayers and businesses. Personal records, financial records, all of it. A hacker is selling the lot after cracking France’s tax authority.

Researchers see a ready-made target list. The country already leads the world in violent crypto robberies. Now it has fresh ammunition for the attackers.

France’s General Directorate of Public Finances, or DGFiP, confirmed the intrusion in late June 2026. The finance minister confirmed it too, per The Block, citing Reuters. The trove covers roughly 1% of France’s population. That’s according to FrenchBreaches, a cyberattack-tracking platform.

Here’s where it gets granular. Decrypt broke down the numbers: 392,867 individuals. 285,570 professionals. Nearly 27,000 had incomes of at least €100,000 ($116,000). Another 386 reported more than $1.16 million. Eight topped $11.6 million.

Stolen fields run the gamut. Names, birthdates, home addresses, phone numbers, email addresses. Tax identifiers, income figures, withholding rates, family status, dependent counts. The hacker uses the moniker “ZeroBytes.” Claims stolen VPN credentials got him into an internal search tool. He extracted records before being cut off. The database is listed for several thousand euros on dark web marketplaces.

No flag for which taxpayers hold crypto. Doesn’t matter, researchers argue. Income data plus home addresses does the job. “Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferable form,” Chainalysis wrote in an early-August report.

France logged 30 publicly known violent crypto attacks in the first half of 2026. More than $30 million netted, per Chainalysis. That pace would blow past the record $58 million stolen in 2025. CertiK, a separate security firm, counted 33 such attacks over the same period. The figures differ. Both firms agree on one thing: France is the single largest country for physical crypto crime.

Consider the playbook. A couple in France’s Somme department got targeted three times in less than a month. They’d moved into a house formerly occupied by crypto millionaires. Tax information and address had surfaced on the dark web. The Block reported the details.

Chainalysis linked the broader trend to another case. A French tax employee accused of selling crypto investors’ confidential information to criminal organizations. Arrested June 2025. The reading raises a question: how many attackers source leads the same way and simply haven’t been caught?

Jameson Lopp, chief security officer at Bitcoin custody firm Casa, wrote on X: “More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked, and 678K records leaked.” Lopp has compiled one of the most extensive public databases of physical attacks on crypto holders. Nearly 12 years of tracking. Bitcoin Magazine reported that the database now tracks incidents across multiple continents. France consistently at the top.

FrenchBreaches disclosed the breach’s scale first. The platform warned that the data enables credible phishing. “A scammer with real tax information and knowing of the existence of an old approach to the DGFiP could, for example, construct a fraudulent message that is much more credible than a simple fake generic email,” the platform said.

Separate incident. Hardware wallet maker Trezor disclosed it Aug. 13. A breach at shipping provider ShipMonk compromised information on nearly 14,000 customers. Phone numbers and addresses of 11,742 people. That leak exposed holders’ physical locations through a different vector entirely.

What remains unknown: the exact number of affected individuals. The 678,437 figure comes from FrenchBreaches. Government hasn’t confirmed it. Investigation ongoing. Unclear whether any crypto holders have been targeted using data from this breach specifically. Unclear whether the dark web listing has found buyers. Unclear whether ZeroBytes’ account of the intrusion method is accurate.

Traders aren’t the ones most exposed here. Never are. The people at risk are the ones whose names and addresses are now for sale.