French Tax Breach Exposes 678,000 as Crypto Attacks Surge
France has emerged as the global center of so-called wrench attacks, in which criminals bypass digital security by kidnapping, assaulting or threatening crypto holders and their relatives until assets are transferred. That risk makes tax records unusually sensitive: names, addresses and income data can help attackers identify and locate wealthy targets. The breach at the Direction générale des Finances publiques, or DGFiP, therefore raises concerns beyond phishing and identity theft, though authorities have not said the compromised records specifically identify cryptocurrency investors.
DGFiP said attackers used stolen identities for an employee and an authorized third party to enter its systems in June and July 2026. After claims surfaced on Aug. 12 and 13, investigators found records on about 678,000 individuals and businesses had been viewed and extracted, including income, withholding-tax and property data; the agency notified France’s privacy regulator, CNIL. Interior Minister Laurent Nuñez said France recorded 77 crypto-linked kidnappings, detentions, extortion cases and attempts in the first half, up from 45 in all of 2025. CertiK separately verified 33 French wrench attacks among 52 worldwide, with global financial exposure reaching $124.1 million.
All Coverage
3 original reportsThe Backstory
The history behind this eventFrance Leads World in Physical Crypto Attacks, Accounting for 70% of Cases
A “wrench attack” involves criminals using kidnapping, assault or coercion to force cryptocurrency holders to surrender private keys or transfer digital assets. France has drawn attention because of its high concentration of such cases. After Ledger’s 2020 customer data breach, centrally stored personal information including names, telephone numbers and home addresses may have been used to target victims, highlighting the physical security risks associated with KYC requirements.
A recent report said about 70% of physical attacks involving cryptocurrency worldwide occur in France. The country has recorded 41 related kidnappings so far in 2026. Experts say past customer data breaches at companies such as Ledger have made it easier for criminal groups to identify cryptocurrency holders and their homes. The cases show that the centralized exposure of identity data collected under regulatory requirements can extend digital-asset risks to personal safety.
France Charges 88 People Over 12 Alleged Crypto Wrench Attacks
So-called wrench attacks use violence, including home invasions, kidnappings and extortion, to force cryptocurrency holders to surrender wallet credentials or transfer assets. Because blockchain wealth is visible and personal information can be readily collected, victims' relatives may also be targeted. The involvement of France's National Prosecutor's Office Against Organized Crime (PNACO) indicates that authorities regard the cases as part of an organized criminal network.
PNACO head Vanessa Perrée said on April 24, 2026, that specialist investigating judges at the Paris Judicial Court were examining 12 cases. A total of 88 people had been charged, including 10 minors, with 75 held in pretrial detention. After consolidating some cases, authorities found that several people were repeatedly implicated. PNACO recorded 18 similar incidents in 2024, 67 in 2025 and 47 from the start of 2026 through April 24. It did not disclose the total amount involved.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →