France DGFIP Tax Data Breach — Crypto Wrench Attack Enablement (August 2026)

2024-09-01

Three armed men assaulted a La Santé prison guard in his Montreuil home. French investigators later allege that Ghalia C., a Bobigny tax office employee, provided the attackers with the victim's address using unauthorized access to Mira, the tax administration's internal software.

2025-01-01

Ledger co-founder David Balland kidnapped in France. One of his fingers was reportedly severed before police rescued him, in a case that drew international attention to France's crypto violence problem.

2025-12-24

Stolen Waltio database — containing data on approximately 50,000 users of the French crypto tax platform — appeared for sale on BreachForums. The breach had not yet been detected by Waltio.

2026-01-10

Ghalia C., the Bobigny tax office employee, is reported to have lost a bail appeal and remains in custody, facing charges of complicity in violence and criminal conspiracy. Case reported by Gizmodo.

2026-02-14

Forbes publishes investigation into France's crypto kidnapping crisis, noting a pattern of 'zero convictions' as a contributing factor in the escalating attack rate.

2026-04-19

CoinDesk publishes investigation into the rise of wrench attacks, documenting France's emergence as global epicenter and quoting TRM Labs on the strategic shift from technical to physical targeting.

2026-06-26

Unauthorized intrusion into DGFiP systems occurs. Attacker allegedly gains access using stolen or misused credentials of a legitimate user, connects to the internal VPN, and uses an internal search tool to extract taxpayer records.

2026-06-30

French Interior Minister Laurent Nuñez publicly discloses that authorities have logged more than 70 crypto-related violent incidents. DGFiP cuts off attacker's access around this period.

2026-07-22

CertiK publishes its H1 2026 Wrench Attacks Report, recording 52 verified global incidents (33 in France), USD 124.1 million in estimated financial exposure, and a 33% year-over-year surge.

2026-07-25

CertiK Intel3D H1 2026 Wrench Attacks Report formally published via GlobeNewswire press release.

2026-08-06

CryptoTimes and other outlets report Chainalysis data confirming France as the global wrench attack hotspot in H1 2026, with over USD 30 million stolen.

2026-08-12

Threat actor ZeroBytes publicly claims responsibility for the DGFiP breach on breach forums, stating data from more than 600,000 individuals was obtained.

2026-08-14

French Finance Ministry confirms the June 2026 DGFiP breach affecting 678,437 taxpayers. Multiple outlets including The Block, Decrypt, and Bitcoin Magazine publish warnings to crypto holders about the compounded physical attack risk.