France’s tax administration, the DGFiP, confirmed that hackers breached its information system and exposed sensitive financial and personal data belonging to hundreds of thousands of taxpayers and businesses Bitcoin Magazine. The leak lands in a country already known as the global leader for “wrench attacks,” where thieves use physical force to steal cryptocurrency.
Bitcoin developer Jameson Lopp warned on X on Friday Bitcoin Magazine that the leak was “more bad news for Bitcoiners living in the leading country for wrench attacks.” Lopp maintains a public tracker that counts physically coercive crypto thefts around the world.
On August 12 the incident became public after an individual operating under the handle “ZeroBytes” advertised on a criminal forum that they had broken into DGFiP systems and stolen VPN logins granting access to an internal taxpayer search tool Bitcoin Magazine. The download was cut short before it finished, so only a partial file of 678,438 records emerged, which the seller is now offering for several thousand euros.
What leaked
FrenchBreaches, a group that reviewed samples of the data, reported roughly 392,867 individuals and 285,570 businesses affected Bitcoin Magazine. Among the individuals, about 26,805 reported annual taxable income above 100,000 euros, 386 exceeded 1,000,000 euros, and 8 exceeded 10,000,000 euros.
According to the sample review, each stolen record carries the person’s full name, birth date and hometown, residential and postal addresses, marriage status, dependent count, the tax office’s internal identifier, the reference income used for assessment, the withholding rate applied, telephone and email contacts, and a log of prior letters exchanged with tax staff. Security analysts warn that this combination of identity, contact, and financial detail can power convincing phishing campaigns that impersonate the tax authority, as well as identity theft and fraud tuned to a victim’s income or family situation.
Why it matters for Bitcoin holders
The danger is not only identity theft. France has become the leading country for wrench attacks, the physical coercion of crypto holders to hand over funds. In 2025, about 55 such attacks were reported globally according to TRM Labs, while Lopp’s tracker logged more than 70, and 54 have already been documented this year Bitcoin Magazine. The pattern drew wide attention when criminals kidnapped Ledger co-founder David Balland and his wife in France, holding the pair for about 24 hours before French authorities rescued them.
The DGFiP breach follows one day after hardware wallet maker Trezor disclosed its own customer data breach, a reminder that crypto holders’ most sensitive records sit in many third-party systems. A separate SafePal breach exposed 39,798 customers’ order data SafePal breach exposes 39,798 customers’ order data.
The report was published by Bitcoin Magazine, whose dedicated news app is listed on Google Play Bitcoin Magazine News on Google Play.
