- A breach at France’s tax administration exposed the details of close to 678,000 people.
- France is on pace for its worst year on record for violent robberies targeting crypto holders.
- The two stories are being reported separately. The link between them is a home address.
Two French stories landed within days of each other. A data breach at the tax administration exposed the details of nearly 678,000 people. And violent robberies aimed at people believed to hold crypto are running at a pace that would make 2026 the worst year France has recorded. Those are not separate stories.
Most crypto security advice is about keeping strangers out of your accounts. None of it helps if someone already knows your name, what you own and which door to knock on. A tax record is one of the few documents that can carry all three, and it is held by an institution you have no choice about handing it to.
If your details were in a French tax filing, there is nothing you did wrong here and nothing you could have done differently. The failure sits with the body that held the data.
What a wrench attack is
The term comes from an old internet cartoon and it has stuck because it describes the problem exactly. You can protect crypto with encryption strong enough that no computer on earth will break it. None of that matters if someone turns up at your house with a wrench and asks for the password.
These are ordinary violent crimes, burglary, kidnapping, assault, with a crypto holder as the target. France has seen a run of them over the past two years, including attacks on the families of people who work in the industry rather than the holders themselves.
Why a tax breach feeds into it
Here is the mechanism, because it is the part the coverage keeps leaving out.
Crypto is unusual in that ownership is public and identity is not. Every transaction sits on a , a shared record anyone can read. Anyone can look up a wallet address and see, to the penny, what it holds and what has moved through it. What the blockchain does not tell you is who that wallet belongs to.
So for someone planning a robbery, the wealth half of the problem is already solved and free to check. The missing half is identity: a name, and a place to find it. Tax records are exactly that. French residents have been required to declare foreign crypto accounts for several years, which means those filings can also indicate who is worth approaching in the first place.
A leaked record does not need to say how much bitcoin someone owns to be useful. It needs to say who they are and where they live. The rest can be worked out.
What the exposure actually looks like
Two things drive the risk, and both are worth understanding separately.
The first is a leak like this one, which nobody can defend against personally. The second is the far larger amount of information people put out themselves: a wallet address posted publicly, a username reused across a forum and an exchange, a photograph of a hardware device, a screenshot of a balance. Any one of those can be the link that connects a public wallet to a real person. Once that link exists it does not go away, because the blockchain does not forget.
That is not a criticism of anyone who has done it. Posting a wallet address to receive a payment is a completely normal thing to do, and the risk it creates was not obvious until attacks like these started happening.
What can be done, and who has to do it
For institutions the list is short and unarguable. A tax authority collecting declarations that identify likely crypto holders takes on a duty of care that goes beyond an ordinary data set, and the same applies to exchanges and platforms holding identity checks alongside balance information. Breach notification needs to tell people precisely what was exposed, because the practical response to a leaked email address is very different from the response to a leaked home address.
For individuals, a few things genuinely reduce exposure. Avoid publishing wallet addresses tied to your real name or usernames you use elsewhere. Avoid disclosing balances publicly, including in screenshots. Split holdings so that no single device or location represents everything, which also reduces what any one confrontation can produce. Keep the delivery address on hardware purchases separate from your home where a service allows it.
In France, cybercrime and threats can be reported through the national platform at cybermalveillance.gouv.fr, and any immediate threat to safety through the police. In the UK, fraud and cyber offences go to Action Fraud, and anything involving a threat of violence goes to the police directly rather than through a fraud reporting line.
What to watch
Whether the French tax administration publishes a precise field-by-field breakdown of what was taken. “Personal data” is not enough for anyone to act on. If home addresses were included, affected people need to be told that plainly and quickly.
Beyond that, whether the attack count keeps climbing through the rest of the year. France is the clearest example so far, but the underlying combination, public balances plus leaked identity records, is not specific to France.