France Sees 90 Attacks on Bitcoiners in Seven Months
French authorities have documented 90 cases involving kidnapping, abduction, extortion, threats, and violent theft related to cryptocurrencies in just over seven months, according to data provided by the French Interior Ministry to Cointelegraph. The figures cover the period from January 1 to mid-August 2026.
During the same period, authorities made 223 arrests, with 126 people imprisoned between January and July. The statistics equate to a new case every two and a half days. The ministry noted that year-on-year comparisons are not available, as systematic recording of these incidents began only on January 1, 2026.
The French figures significantly exceed publicly tracked incidents. Chainalysis counted 30 publicly known violent crypto incidents in France through mid-2026, though the firm acknowledged the actual scale was almost certainly larger. Security firm Gart.io has tracked 73 attacks in France year-to-date, placing the country ahead of the United States with 66 attacks and the United Kingdom with 27.
Data Breaches Drive Targeting
The surge in physical attacks on crypto holders in France points to compromised personal data as a likely catalyst. Eric Jardine, head researcher at Chainalysis, told Cointelegraph the spike is very likely due to a significant data breach that exposed not just financial information, but details about who holds crypto, where they live, and how to find them.
A French tax official named Ghalia C., age 32, was detained on June 30, 2025, and charged with complicity in violence and criminal conspiracy. She allegedly used tax administration software to search for cryptocurrency investors and sold their personal data to criminal organizations. The official exploited tax authority databases to access addresses and capital gains information of cryptocurrency holders.
Chainalysis analysis suggests this tax authority compromise may have been the accelerant, with attacks surging from late November 2024 onward.
A further breach occurred in January 2026 when crypto tax reporting firm Waltio disclosed a compromise affecting approximately 50,000 users. The hacking group Shiny Hunters was allegedly behind the incident, with the stolen database appearing on a dark web forum on December 24, 2025, nearly a month before Waltio became aware of the breach on January 21, 2026.
Global Context and Scale
Physical attacks on cryptocurrency holders, known as wrench attacks, are far from a new phenomenon. The term originates from a 2013 XKCD webcomic that satirically illustrated how physical coercion with a $5 wrench could bypass even the strongest cryptographic security by targeting the human holder of the password.
Bitcoin security advocate Jameson Lopp's long-running directory has documented 365 known physical attacks across 60 countries between 2014 and 2026, with France now topping the leaderboard. A 2025 Skynet report documented 72 verified physical coercion incidents worldwide in 2025, representing a 75% increase compared to 2024, with kidnapping remaining the primary attack vector and physical assaults rising 250% year-over-year.
Chainalysis estimated that criminals stole more than $30 million through violent crypto attacks globally in the first half of 2026, with home invasions accounting for 37% of recorded cases.
Geographic Spread and Victim Profile
What appears new is the speed at which violent crypto crimes are spreading throughout France. Attacks have moved beyond Paris to cities including Strasbourg, Marseille, Grenoble, Toulouse, and Nantes, according to Chainalysis. Criminals are not targeting crypto-rich tourists; of victims with known residency, 93% were French.
One of the most revealing changes concerns who is being attacked. Globally, relatives and acquaintances accounted for around 25% to 30% of violent crypto incidents by early 2026. In France, that proportion exceeded 40%.
In May 2026, six men allegedly attempted to abduct the wife of The Sandbox co-founder Sébastien Borget from the couple's home in Villenoy. One attacker posed as a delivery driver to get her to open the gate. The two suspects who were arrested were teenagers born in 2009 and 2010, caught after ordering an Uber to flee the scene. They were found with a replica gun, cable ties, and balaclavas.
In August, a couple in rural France reportedly endured three separate break-in attempts at their home after purchasing a property previously occupied by crypto millionaires, whose tax information and address had been leaked onto the dark web.
A similar tactic was used in 2025 when the father of a crypto entrepreneur was abducted in Paris and held for two days. The kidnappers reportedly cut off part of his finger and sent it to his son while demanding $5.6 million in cryptocurrency.
Jardine says the targeting of relatives and associates suggests criminals are conducting reconnaissance before they act, whether by monitoring social media, analyzing blockchain data, using leaked information, or receiving tips from insiders. This approach turns the usual idea of a crypto target on its head, since the person with the wallet may not be the person standing in front of the attacker.
Regulatory Framework Under Scrutiny
Francis Pouliot, founder of Canadian Bitcoin exchange Bull Bitcoin, has repeatedly challenged Europe's DAC8 crypto reporting rules, describing the regulation as having transformed the concept of Know Your Customer into Kill Your Customer. He labeled France as the crypto kidnapping capital of the world.
The EU's DAC8 directive, which took effect January 1, 2026, requires crypto-asset service providers across all 27 EU member states to collect detailed user and transaction data and report it to national tax authorities, with first reports due by September 30, 2027. The directive aligns with the OECD's Crypto-Asset Reporting Framework, with 77 jurisdictions having committed to CARF as of September 14, 2026, including 46 planning first exchanges by 2027.
Critics argue that expanded tax reporting and information-sharing requirements create security risks by centralizing sensitive data about cryptocurrency holders, potentially making that information vulnerable to breaches or insider threats.
