Audit log

Every state-changing event for France DGFIP Tax Data Breach — Crypto Wrench Attack Enablement (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-15 23:12:56Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   DmXemUHHTTq4…fxLrYx1ncopysha256 → base58

   verifying row…

   canonical bytes (35584 B) ▸

   {"actor":"system:backfill","investigation_id":"d60b5eec-d2d5-4189-9390-291aa8a829cf","kind":"publish","page_slug":"france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026","published_at":"2026-08-15T23:12:56.304Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"France DGFIP Tax Data Breach — Crypto Wrench Attack Enablement (August 2026)","sections":[{"content":"The DGFiP confirmed that unauthorized access to its information systems occurred in late June 2026. According to the French Finance Ministry and reporting by Recorded Future's The Record (August 14, 2026), the attacker allegedly obtained access by stealing or misusing the identity of an individual who already had legitimate access to the system. The attacker reportedly connected to an internal VPN and used an internal search tool to extract records on both individual and professional taxpayers.\n\nOn August 12, 2026, a threat actor using the alias ZeroBytes publicly claimed responsibility on breach forums and stated they had obtained data on more than 600,000 individuals. French authorities have confirmed the June intrusion but have not publicly attributed the breach to ZeroBytes or independently verified all claims in the threat actor's post. Investigations are being conducted by ANSSI (the French national cybersecurity agency), CNIL (the French data protection authority), and the High Official for Defense and Security's service. A criminal complaint has been filed.\n\nData reported as compromised includes: full names, dates of birth, residential addresses, telephone numbers, email addresses, reference taxable income, family quotient figures, withholding tax rates, dependent counts, and — for professional accounts — company names and SIREN identifiers. The claimed scope is 392,867 individual accounts and 285,570 professional accounts, totalling 678,437 records. DGFiP has committed to notifying affected individuals and specifying what data was exposed for each person.\n\nA separate, unconfirmed claim by ZeroBytes alleges a second dataset of 2,041,778 records from a Professional Land Data Server; this claim has not been verified by French authorities and should be treated as unconfirmed at this stage.","heading":"Breach Overview and Confirmed Facts","severity":"critical","sources":[{"credibility":1,"name":"France investigates tax authority breach after hacker claims 600,000 victims — The Record (Recorded Future News)","type":"news_article","url":"https://therecord.media/french-tax-authority-dgfip-confirms-data-breach"},{"credibility":2,"name":"France: 680,000 Taxpayers Threatened After a Cyberattack Against the DGFiP — CoinTribune","type":"news_article","url":"https://www.cointribune.com/en/france-680000-taxpayers-threatened-after-a-cyberattack-against-the-dgfip"},{"credibility":2,"name":"France Tax Data Leak Could Fuel Scams, Attacks Targeting Bitcoin Holders — Decrypt","type":"news_article","url":"https://decrypt.co/375715/france-tax-data-leak-wrench-attacks-bitcoin"},{"credibility":2,"name":"French tax breach exposes nearly 678,000 people as crypto wrench attacks pile up — The Block","type":"news_article","url":"https://www.theblock.co/amp/news/ecosystems/2026-08-14-french-tax-breach-exposes-nearly-678000-people-crypto-wrench-attacks-pile-up-411876"}]},{"content":"Analysis of the claimed dataset, as reported by Decrypt and Crypto Economy, identifies a significant concentration of high-income individuals whose financial profiles make them disproportionate targets for physical coercion. Within the 678,437-record dataset: approximately 26,805 individuals declared annual taxable income of at least EUR 100,000 (approximately USD 116,000 at current exchange rates); 386 individuals declared income above EUR 1,000,000; and 8 individuals declared income exceeding EUR 10,000,000.\n\nSecurity researchers cited by multiple outlets note that the combination of tax income data, residential addresses, phone numbers, and email addresses in a single record set enables criminals to construct highly targeted attack profiles without additional reconnaissance. According to analysis by FrenchBreaches cited in Decrypt, criminals can use such data to rank potential victims by income, property ownership, and likely crypto asset exposure, producing what amounts to a geographically searchable attack list. The hacker was reported by Cointribune to be seeking several thousand euros for access to the data, making it financially accessible to organized criminal networks.","heading":"High-Value Target Stratification in the Stolen Dataset","severity":"critical","sources":[{"credibility":2,"name":"France Tax Data Leak Could Fuel Scams, Attacks Targeting Bitcoin Holders — Decrypt","type":"news_article","url":"https://decrypt.co/375715/france-tax-data-leak-wrench-attacks-bitcoin"},{"credibility":2,"name":"France's Massive Tax Data Breach Puts 678,000 People at Risk as Crypto Attacks Soar — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/frances-massive-tax-data-breach-puts-678000-people-at-risk-as-crypto-attacks-soar/"},{"credibility":2,"name":"France: 680,000 Taxpayers Threatened After a Cyberattack Against the DGFiP — CoinTribune","type":"news_article","url":"https://www.cointribune.com/en/france-680000-taxpayers-threatened-after-a-cyberattack-against-the-dgfip"}]},{"content":"Multiple independent research firms confirm France's position as the country with the highest documented rate of physical coercion attacks targeting cryptocurrency holders in 2026.\n\nCertiK's Intel3D H1 2026 Wrench Attacks Report (published July 25, 2026) recorded 52 verified physical attacks globally in the first half of 2026, up 33% from 39 incidents in H1 2025. France accounted for 33 of those 52 incidents — 63.5% of the global total and 84.6% of European cases. CertiK estimated total financial exposure at USD 124.1 million, with average per-incident exposure rising from approximately USD 270,000 in H1 2025 to USD 2.39 million in H1 2026. Attack methods shifted significantly: home invasions rose from 1 recorded case in H1 2025 to 20 in H1 2026; kidnappings rose from 12 to 16; torture incidents numbered 4; one murder was recorded.\n\nChainalysis, tracking a partially overlapping dataset through mid-2026, documented 46 incidents globally with over USD 30 million in confirmed stolen cryptocurrency, with France accounting for approximately 30 of those cases — also the highest national count in its dataset.\n\nFrench Interior Minister Laurent Nuñez disclosed that authorities had logged more than 70 crypto-related violent incidents as of late June 2026. A separate report from Crypto Briefing (citing French authorities) placed the figure at 77 kidnapping, unlawful detention, and extortion cases tied to cryptocurrency in H1 2026 alone — already exceeding the approximately 45 cases recorded across all of 2025. French authorities reported approximately 200 arrests and at least 88 individuals formally charged across 12 separate investigations as of the reporting date.\n\nCoinDesk's April 2026 investigation quoted Phil Ariss of TRM Labs describing a strategic shift among attackers: 'We're seeing a shift from find a wallet to hunt a person,' with victims identified through social media, public appearances, and leaked datasets. Security researcher Jameson Lopp, quoted in Bitcoin Magazine (August 14, 2026), described France as 'already the epicenter of wrench attacks.' Lopp maintains an ongoing database of physical cryptocurrency attacks and has noted that many cases go unreported.","heading":"France as the Global Epicenter of Crypto Wrench Attacks","severity":"critical","sources":[{"credibility":2,"name":"CertiK Intel3D H1 2026 Wrench Attacks Report press release — GlobeNewswire","type":"research","url":"https://www.globenewswire.com/news-release/2026/07/25/3333162/0/en/certik-intel3d-h1-2026-wrench-attacks-report-reveals-33-surge-in-physical-crypto-crime-estimated-losses-top-124-million.html"},{"credibility":2,"name":"CertiK Intel3D H1 2026 Wrench Attacks — CertiK official report","type":"research","url":"https://www.certik.com/certik-report/intel3d/intel3d-wrench-h1-2026"},{"credibility":2,"name":"More than $30 million stolen in violent crypto attacks in 2026 as France emerges as wrench attack hotspot: Chainalysis — The Block","type":"news_article","url":"https://www.theblock.co/post/410984/more-than-30-million-stolen-in-violent-crypto-attacks-in-2026-as-france-emerges-as-wrench-attack-hotspot-chainalysis"},{"credibility":2,"name":"Crypto Wrench Attacks Top $30M as France Emerges as Hotspot — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/06/crypto-wrench-attacks-top-30m-as-france-emerges-as-hotspot/"},{"credibility":1,"name":"Inside the Rise of Wrench Attacks Against Crypto Holders and How France Has Become the Focus — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/04/19/inside-the-rise-of-wrench-attacks-against-crypto-holders-and-how-france-has-become-the-focus"},{"credibility":2,"name":"Bitcoiners Warned of Wrench Attacks After Tax Authority Leak — Bitcoin Magazine","type":"news_article","url":"https://bitcoinmagazine.com/news/bitcoiners-warned-of-wrench-attacks"},{"credibility":2,"name":"France reports 77 crypto-linked kidnapping cases in H1 2026 — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/france-crypto-kidnapping-cases-2026-2/"},{"credibility":2,"name":"Violent crypto attacks surge in 2026 with over $124M in financial exposure, France hit hardest — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/violent-crypto-attacks-surge-2026-france/"}]},{"content":"The 2026 DGFiP breach occurs against a backdrop of a confirmed predecessor incident in which a French government employee allegedly sold sensitive taxpayer data directly to criminal networks.\n\nFrench media and multiple outlets including Gizmodo (January 10, 2026) and IMI Daily reported that Ghalia C., a 32-year-old employee at the Bobigny tax office in the Paris area, is alleged to have accessed sensitive financial records through the tax administration's internal Mira software and sold personal dossiers on high-net-worth individuals — including identified cryptocurrency holders — to criminal intermediaries. Investigators found that her workstation contained searches specifically targeting cryptocurrency specialists and investors. She allegedly received payment via bank cash deposits and Western Union transfers.\n\nThe investigation began after three armed men assaulted a prison guard from La Santé prison in his Montreuil home in September 2024. Prosecutors allege Ghalia C. provided attackers with the victim's precise address obtained through unauthorized tax system searches. She has been held in custody since June 30, 2025, following an unsuccessful bail appeal, and faces charges of complicity in violence against a public official and criminal conspiracy. She has not been convicted as of the time of this writing; the charges represent allegations at the prosecution stage.\n\nHer alleged statement, as reported by Gizmodo: 'I gave information about this person. I knew nothing of what was done and I would like to ask forgiveness from this couple who were attacked.'\n\nThis case established a documented chain from internal government data access to physical violence against crypto holders in France, and has been cited by CertiK and Chainalysis as a contributing factor to France's elevated attack rate.","heading":"Predecessor Incident: 2024 Tax Official Data Sale to Criminals","severity":"high","sources":[{"credibility":2,"name":"French Tax Agent Allegedly Sold Personal Data of Crypto Users to Criminals — Gizmodo","type":"news_article","url":"https://gizmodo.com/french-tax-agent-allegedly-sold-personal-data-of-crypto-users-to-criminals-2000707279"},{"credibility":2,"name":"French Tax Official Sold Cryptocurrency Investor Data to Criminal Networks — IMI Daily","type":"news_article","url":"https://www.imidaily.com/tax/french-tax-official-sold-cryptocurrency-investor-data-to-criminal-networks/"},{"credibility":2,"name":"Insiders sell government crypto database to violent home invaders as transparency laws backfire — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tax-databases-just-enabled-a-home-attack-and-crypto-investors-are-on-the-same-menu/"},{"credibility":1,"name":"France Crypto Kidnappings: Leaks and Zero Convictions Fuel the Crisis — Forbes","type":"news_article","url":"https://www.forbes.com/sites/digital-assets/2026/02/14/france-crypto-kidnappings-leaks-and-zero-convictions-fuel-the-crisis/"}]},{"content":"In addition to the DGFiP and the 2024 insider incident, France experienced a further data breach at Waltio, a French cryptocurrency tax reporting platform, with approximately 50,000 users affected. The stolen database appeared on dark web marketplace BreachForums around December 24, 2025, according to threat intelligence firm Brinztech, approximately one month before Waltio was aware of the breach. The attack was associated with the Shiny Hunters hacking group.\n\nCompromised data included email addresses and summarized cryptocurrency gains, losses, and year-end balances from 2024 tax filings. Waltio stated that passwords, wallet addresses, and bank data were not compromised. However, hackers subsequently claimed on BreachForums that the stolen data was directly linked to at least three kidnappings that collectively netted criminals a reported USD 17.1 million. This claim has not been independently verified, and it was made by the threat actors themselves; it should be treated as an unverified allegation from a self-interested party.\n\nThe Paris Public Prosecutor's Office opened a preliminary investigation, and the National Cyber Unit of the Gendarmerie was tasked with establishing the scope of exposure. Cointelegraph reported on the French authorities' investigation into the Waltio breach.\n\nThe Waltio incident, the 2024 Ghalia C. case, and the 2026 DGFiP breach together represent three distinct data exposure events that, in combination, have substantially increased the pool of identifiable crypto holders in France available to criminal networks.","heading":"Waltio Platform Breach: Compounding the Exposure Landscape","severity":"high","sources":[{"credibility":2,"name":"Waltio Data Breach: 50K Users Affected in France — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/waltio-data-breach-50k-users-france/"},{"credibility":2,"name":"Hackers extort French crypto company Waltio after pinching data from 50,000 users — DL News","type":"news_article","url":"https://www.dlnews.com/articles/regulation/hackers-extort-french-crypto-firm-waltio/"},{"credibility":2,"name":"Fears spread in France that a crypto platform data leak leads to real-world abductions — CyberNews","type":"news_article","url":"https://cybernews.com/security/hackers-say-waltio-leak-linked-to-french-crypto-kidnappings/"},{"credibility":2,"name":"French Authorities Investigate Data Breach of Crypto Tax Platform — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/french-authorities-data-breach-waltio"}]},{"content":"Security researchers, journalists, and blockchain analytics firms have identified a direct operational link between financial data exposure and physical targeting of crypto holders in France. The mechanism, documented across the three breach events described above, follows a consistent pattern: leaked datasets containing names, addresses, and income or crypto balance data are acquired — either through purchase on dark web forums or via criminal intermediaries with government access — cross-referenced against publicly available blockchain data and social media presence, and then used to build ranked target lists for home invasion or kidnapping operations.\n\nPhil Ariss of TRM Labs described the evolution in CoinDesk's April 2026 investigation: 'We're seeing a shift from find a wallet to hunt a person.' CertiK's H1 2026 report noted that the combination of France's visible crypto ecosystem and successive major data breaches likely contributed directly to its outsized share of global wrench attack incidents.\n\nThe DGFiP breach specifically introduces income data — reference taxable income, withholding rates — that does not require any blockchain analysis to identify wealth. For criminals who lack technical capability to trace crypto wallets on-chain, this provides a simpler, lower-skill path to target selection based solely on declared income level. The 386 individuals with declared income above EUR 1 million and 8 with declared income above EUR 10 million represent a small, easily enumerable set of extremely high-value targets within the stolen dataset.\n\nCertiK's report recommends that traditional custody practices such as hardware wallets and offline seed phrases are no longer sufficient protection, and advocates for multi-signature and MPC wallet setups, withdrawal delays, staged vault architecture, and family preparedness protocols as mitigations against physical coercion.","heading":"Systemic Risk: Data-to-Violence Attack Chain","severity":"critical","sources":[{"credibility":2,"name":"CertiK Intel3D H1 2026 Wrench Attacks Report — GlobeNewswire press release","type":"research","url":"https://www.globenewswire.com/news-release/2026/07/25/3333162/0/en/certik-intel3d-h1-2026-wrench-attacks-report-reveals-33-surge-in-physical-crypto-crime-estimated-losses-top-124-million.html"},{"credibility":1,"name":"Inside the Rise of Wrench Attacks Against Crypto Holders and How France Has Become the Focus — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/04/19/inside-the-rise-of-wrench-attacks-against-crypto-holders-and-how-france-has-become-the-focus"},{"credibility":2,"name":"France's Massive Tax Data Breach Puts 678,000 People at Risk as Crypto Attacks Soar — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/frances-massive-tax-data-breach-puts-678000-people-at-risk-as-crypto-attacks-soar/"},{"credibility":2,"name":"France Tax Data Leak Exposes 678,000 Accounts to New Fraud Risk — Blockonomi","type":"news_article","url":"https://blockonomi.com/france-tax-data-leak-exposes-678000-accounts-to-new-fraud-risk"}]},{"content":"French authorities have acknowledged the severity of the wrench attack crisis and have announced measures in response, though the scale of the response has been described as lagging behind the pace of attacks.\n\nFrench Interior Minister Laurent Nuñez disclosed the 70+ violent crypto case figure publicly in late June 2026 and, alongside Minister Delegate to the Interior Ministry Jean-Didier Berger, announced that new security measures were being prepared. French authorities have reported approximately 200 arrests in connection with crypto-related violent crimes and at least 88 individuals formally charged across 12 separate investigations, according to CoinMarketCap reporting citing Chainalysis data.\n\nFor the DGFiP breach specifically, the Finance Ministry confirmed it will notify affected individuals directly, specifying what data was exposed for each person. CNIL, France's data protection authority, has been formally notified. ANSSI is assisting with the investigation. A criminal complaint has been filed by DGFiP.\n\nForbes reported in February 2026 that a pattern of 'zero convictions' in crypto-linked violent crime cases had become a contributing factor in the escalating crisis, as low prosecution success rates may have reduced deterrence. This reporting predates the arrests and charges announced later in H1 2026, and the current conviction rate is not confirmed in available sourcing.","heading":"French Government Response and Law Enforcement Measures","severity":"medium","sources":[{"credibility":2,"name":"Crypto Wrench Attacks Top $30M as France Emerges as Hotspot — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/06/crypto-wrench-attacks-top-30m-as-france-emerges-as-hotspot/"},{"credibility":1,"name":"France Crypto Kidnappings: Leaks and Zero Convictions Fuel the Crisis — Forbes","type":"news_article","url":"https://www.forbes.com/sites/digital-assets/2026/02/14/france-crypto-kidnappings-leaks-and-zero-convictions-fuel-the-crisis/"},{"credibility":2,"name":"Crypto 'Wrench Attacks' Surpass $30M in H1 2026 With France at the Center — CoinMarketCap Academy","type":"news_article","url":"https://coinmarketcap.com/academy/article/crypto-wrench-attacks-chainalysis-france-2026"},{"credibility":3,"name":"France Vows Tougher Response After 77 Crypto Wrench Attacks — GNCrypto News","type":"news_article","url":"https://www.gncrypto.news/news/france-vows-tougher-response-after-77-crypto-wrench-attacks/"}]},{"content":"Journalists and researchers have cited specific incidents to illustrate the operational reality of France's wrench attack crisis.\n\nIn January 2025, Ledger co-founder David Balland was kidnapped in France. According to CoinDesk's April 2026 investigation, Balland's finger was severed as part of a ransom demand before police rescued him. This case received significant international media coverage and is frequently cited as a turning point in awareness of France's vulnerability.\n\nThe Block reported on August 12, 2026, that attackers carried out multiple home invasions at a rural French address after a crypto millionaire had already relocated. The story illustrates that stale data from earlier breaches or public records continues to drive physical attacks even when targets have moved.\n\nThe Waltio hackers' unverified claim — that the stolen Waltio data was directly linked to at least three kidnappings producing USD 17.1 million in criminal proceeds — if accurate, would represent one of the most financially significant data-to-violence chains documented. This claim should be treated with caution as it originates from the threat actors themselves on BreachForums and has not been independently verified by French authorities in available reporting.","heading":"Notable Attack Cases Referenced in Reporting","severity":"high","sources":[{"credibility":1,"name":"Inside the Rise of Wrench Attacks Against Crypto Holders and How France Has Become the Focus — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/04/19/inside-the-rise-of-wrench-attacks-against-crypto-holders-and-how-france-has-become-the-focus"},{"credibility":2,"name":"Attackers keep hitting the wrong house in rural France after crypto millionaire moved — The Block","type":"news_article","url":"https://www.theblock.co/news/regulation/2026-08-12-attackers-keep-hitting-wrong-house-rural-france-after-crypto-millionaire-moved-report-411605"},{"credibility":2,"name":"Fears spread in France that a crypto platform data leak leads to real-world abductions — CyberNews","type":"news_article","url":"https://cybernews.com/security/hackers-say-waltio-leak-linked-to-french-crypto-kidnappings/"},{"credibility":3,"name":"Crypto millionaire data leak sparks three home invasions at wrong French address — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33287221/"}]}],"sources_used":[{"credibility":1,"name":"France investigates tax authority breach after hacker claims 600,000 victims — The Record (Recorded Future News)","type":"news_article","url":"https://therecord.media/french-tax-authority-dgfip-confirms-data-breach"},{"credibility":1,"name":"Inside the Rise of Wrench Attacks Against Crypto Holders and How France Has Become the Focus — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/04/19/inside-the-rise-of-wrench-attacks-against-crypto-holders-and-how-france-has-become-the-focus"},{"credibility":1,"name":"France Crypto Kidnappings: Leaks and Zero Convictions Fuel the Crisis — Forbes","type":"news_article","url":"https://www.forbes.com/sites/digital-assets/2026/02/14/france-crypto-kidnappings-leaks-and-zero-convictions-fuel-the-crisis/"},{"credibility":2,"name":"CertiK's H1 2026 Wrench Attacks Report Finds $124 Million in Losses — CoinDesk press release","type":"research","url":"https://www.coindesk.com/press-release/2026/07/22/certik-s-h1-2026-wrench-attacks-report-finds-usd124-million-in-losses-as-physical-coercion-attacks-surge-33"},{"credibility":2,"name":"CertiK Intel3D H1 2026 Wrench Attacks Report press release — GlobeNewswire","type":"research","url":"https://www.globenewswire.com/news-release/2026/07/25/3333162/0/en/certik-intel3d-h1-2026-wrench-attacks-report-reveals-33-surge-in-physical-crypto-crime-estimated-losses-top-124-million.html"},{"credibility":2,"name":"CertiK Intel3D H1 2026 Wrench Attacks — CertiK official","type":"research","url":"https://www.certik.com/certik-report/intel3d/intel3d-wrench-h1-2026"},{"credibility":2,"name":"French tax breach exposes nearly 678,000 people as crypto wrench attacks pile up — The Block","type":"news_article","url":"https://www.theblock.co/amp/news/ecosystems/2026-08-14-french-tax-breach-exposes-nearly-678000-people-crypto-wrench-attacks-pile-up-411876"},{"credibility":2,"name":"France Tax Data Leak Could Fuel Scams, Attacks Targeting Bitcoin Holders — Decrypt","type":"news_article","url":"https://decrypt.co/375715/france-tax-data-leak-wrench-attacks-bitcoin"},{"credibility":2,"name":"France's Massive Tax Data Breach Puts 678,000 People at Risk as Crypto Attacks Soar — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/frances-massive-tax-data-breach-puts-678000-people-at-risk-as-crypto-attacks-soar/"},{"credibility":2,"name":"Crypto Wrench Attacks Top $30M as France Emerges as Hotspot — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/06/crypto-wrench-attacks-top-30m-as-france-emerges-as-hotspot/"},{"credibility":2,"name":"More than $30 million stolen in violent crypto attacks in 2026 as France emerges as wrench attack hotspot: Chainalysis — The Block","type":"news_article","url":"https://www.theblock.co/post/410984/more-than-30-million-stolen-in-violent-crypto-attacks-in-2026-as-france-emerges-as-wrench-attack-hotspot-chainalysis"},{"credibility":2,"name":"French Tax Agent Allegedly Sold Personal Data of Crypto Users to Criminals — Gizmodo","type":"news_article","url":"https://gizmodo.com/french-tax-agent-allegedly-sold-personal-data-of-crypto-users-to-criminals-2000707279"},{"credibility":2,"name":"French Tax Official Sold Cryptocurrency Investor Data to Criminal Networks — IMI Daily","type":"news_article","url":"https://www.imidaily.com/tax/french-tax-official-sold-cryptocurrency-investor-data-to-criminal-networks/"},{"credibility":2,"name":"Insiders sell government crypto database to violent home invaders as transparency laws backfire — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tax-databases-just-enabled-a-home-attack-and-crypto-investors-are-on-the-same-memo/"},{"credibility":2,"name":"Waltio Data Breach: 50K Users Affected in France — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/waltio-data-breach-50k-users-france/"},{"credibility":2,"name":"Hackers extort French crypto company Waltio after pinching data from 50,000 users — DL News","type":"news_article","url":"https://www.dlnews.com/articles/regulation/hackers-extort-french-crypto-firm-waltio/"},{"credibility":2,"name":"Fears spread in France that a crypto platform data leak leads to real-world abductions — CyberNews","type":"news_article","url":"https://cybernews.com/security/hackers-say-waltio-leak-linked-to-french-crypto-kidnappings/"},{"credibility":2,"name":"French Authorities Investigate Data Breach of Crypto Tax Platform — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/french-authorities-data-breach-waltio"},{"credibility":2,"name":"France: 680,000 Taxpayers Threatened After a Cyberattack Against the DGFiP — CoinTribune","type":"news_article","url":"https://www.cointribune.com/en/france-680000-taxpayers-threatened-after-a-cyberattack-against-the-dgfip"},{"credibility":2,"name":"France reports 77 crypto-linked kidnapping cases in H1 2026 — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/france-crypto-kidnapping-cases-2026-2/"},{"credibility":2,"name":"Violent crypto attacks surge in 2026 with over $124M in financial exposure, France hit hardest — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/violent-crypto-attacks-surge-2026-france/"},{"credibility":2,"name":"Bitcoiners Warned of Wrench Attacks After Tax Authority Leak — Bitcoin Magazine","type":"news_article","url":"https://bitcoinmagazine.com/news/bitcoiners-warned-of-wrench-attacks"},{"credibility":2,"name":"Attackers keep hitting the wrong house in rural France after crypto millionaire moved — The Block","type":"news_article","url":"https://www.theblock.co/news/regulation/2026-08-12-attackers-keep-hitting-wrong-house-rural-france-after-crypto-millionaire-moved-report-411605"},{"credibility":3,"name":"France Vows Tougher Response After 77 Crypto Wrench Attacks — GNCrypto News","type":"news_article","url":"https://www.gncrypto.news/news/france-vows-tougher-response-after-77-crypto-wrench-attacks/"},{"credibility":2,"name":"Crypto 'Wrench Attacks' Surpass $30M in H1 2026 With France at the Center — CoinMarketCap Academy","type":"news_article","url":"https://coinmarketcap.com/academy/article/crypto-wrench-attacks-chainalysis-france-2026"},{"credibility":2,"name":"France Tax Data Leak Exposes 678,000 Accounts to New Fraud Risk — Blockonomi","type":"news_article","url":"https://blockonomi.com/france-tax-data-leak-exposes-678000-accounts-to-new-fraud-risk"},{"credibility":3,"name":"Crypto millionaire data leak sparks three home invasions at wrong French address — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33287221/"}],"summary":"In late June 2026, an unauthorized intrusion into France's General Directorate of Public Finances (DGFiP) exposed the personal and financial data of an estimated 678,437 taxpayers, including names, addresses, income figures, withholding rates, and tax identifiers. The breach was publicly claimed on August 12, 2026 by a threat actor using the pseudonym ZeroBytes, and confirmed by French authorities on August 14, 2026. The incident directly amplifies an established pattern of violent physical coercion — so-called wrench attacks — against crypto holders in France, which CertiK and Chainalysis both identified as the global epicenter of such attacks in H1 2026.","timeline":[{"date":"2024-09-01","event":"Three armed men assaulted a La Santé prison guard in his Montreuil home. French investigators later allege that Ghalia C., a Bobigny tax office employee, provided the attackers with the victim's address using unauthorized access to Mira, the tax administration's internal software.","source":"Gizmodo","source_url":"https://gizmodo.com/french-tax-agent-allegedly-sold-personal-data-of-crypto-users-to-criminals-2000707279"},{"date":"2025-01-01","event":"Ledger co-founder David Balland kidnapped in France. One of his fingers was reportedly severed before police rescued him, in a case that drew international attention to France's crypto violence problem.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/04/19/inside-the-rise-of-wrench-attacks-against-crypto-holders-and-how-france-has-become-the-focus"},{"date":"2025-12-24","event":"Stolen Waltio database — containing data on approximately 50,000 users of the French crypto tax platform — appeared for sale on BreachForums. The breach had not yet been detected by Waltio.","source":"DL News","source_url":"https://www.dlnews.com/articles/regulation/hackers-extort-french-crypto-firm-waltio/"},{"date":"2026-01-10","event":"Ghalia C., the Bobigny tax office employee, is reported to have lost a bail appeal and remains in custody, facing charges of complicity in violence and criminal conspiracy. Case reported by Gizmodo.","source":"Gizmodo","source_url":"https://gizmodo.com/french-tax-agent-allegedly-sold-personal-data-of-crypto-users-to-criminals-2000707279"},{"date":"2026-02-14","event":"Forbes publishes investigation into France's crypto kidnapping crisis, noting a pattern of 'zero convictions' as a contributing factor in the escalating attack rate.","source":"Forbes","source_url":"https://www.forbes.com/sites/digital-assets/2026/02/14/france-crypto-kidnappings-leaks-and-zero-convictions-fuel-the-crisis/"},{"date":"2026-04-19","event":"CoinDesk publishes investigation into the rise of wrench attacks, documenting France's emergence as global epicenter and quoting TRM Labs on the strategic shift from technical to physical targeting.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/04/19/inside-the-rise-of-wrench-attacks-against-crypto-holders-and-how-france-has-become-the-focus"},{"date":"2026-06-26","event":"Unauthorized intrusion into DGFiP systems occurs. Attacker allegedly gains access using stolen or misused credentials of a legitimate user, connects to the internal VPN, and uses an internal search tool to extract taxpayer records.","source":"The Record (Recorded Future News)","source_url":"https://therecord.media/french-tax-authority-dgfip-confirms-data-breach"},{"date":"2026-06-30","event":"French Interior Minister Laurent Nuñez publicly discloses that authorities have logged more than 70 crypto-related violent incidents. DGFiP cuts off attacker's access around this period.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/06/crypto-wrench-attacks-top-30m-as-france-emerges-as-hotspot/"},{"date":"2026-07-22","event":"CertiK publishes its H1 2026 Wrench Attacks Report, recording 52 verified global incidents (33 in France), USD 124.1 million in estimated financial exposure, and a 33% year-over-year surge.","source":"CoinDesk press release","source_url":"https://www.coindesk.com/press-release/2026/07/22/certik-s-h1-2026-wrench-attacks-report-finds-usd124-million-in-losses-as-physical-coercion-attacks-surge-33"},{"date":"2026-07-25","event":"CertiK Intel3D H1 2026 Wrench Attacks Report formally published via GlobeNewswire press release.","source":"GlobeNewswire","source_url":"https://www.globenewswire.com/news-release/2026/07/25/3333162/0/en/certik-intel3d-h1-2026-wrench-attacks-report-reveals-33-surge-in-physical-crypto-crime-estimated-losses-top-124-million.html"},{"date":"2026-08-06","event":"CryptoTimes and other outlets report Chainalysis data confirming France as the global wrench attack hotspot in H1 2026, with over USD 30 million stolen.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/06/crypto-wrench-attacks-top-30m-as-france-emerges-as-hotspot/"},{"date":"2026-08-12","event":"Threat actor ZeroBytes publicly claims responsibility for the DGFiP breach on breach forums, stating data from more than 600,000 individuals was obtained.","source":"CoinTribune","source_url":"https://www.cointribune.com/en/france-680000-taxpayers-threatened-after-a-cyberattack-against-the-dgfip"},{"date":"2026-08-14","event":"French Finance Ministry confirms the June 2026 DGFiP breach affecting 678,437 taxpayers. Multiple outlets including The Block, Decrypt, and Bitcoin Magazine publish warnings to crypto holders about the compounded physical attack risk.","source":"The Record (Recorded Future News)","source_url":"https://therecord.media/french-tax-authority-dgfip-confirms-data-breach"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0c54e4fd-53c1-4bcd-8fd4-fbf638dad58ecopy