2,3 millions de détenteurs crypto français ciblés

A ZATAZ report has uncovered two separate cybercrime listings offering access to a database of 2.3 million French cryptocurrency holders, containing sensitive information like identities, contact details, addresses, and financial estimates. The listings highlight a growing trend of targeting French crypto users, particularly in light of recent criminal activity and investigations related to crypto-linked kidnappings and extortion attempts. The data suggests a potential link between crypto holdings and physical location, raising serious security concerns given the increasing number of criminal incidents targeting the crypto ecosystem in France. The source indicates that the data may be derived from multiple sources and could be used for targeted phishing campaigns, data profiling, and physical targeting.

Two announcements published on a cybercrime space claim to offer a combined database of 2.3 million French individuals linked to cryptocurrencies. The vendor boasts that the sample demonstrates the wealth of information available. This data alone illustrates the potential risk without exposing the victims.

The listings include details such as phone numbers, email addresses, full names, dates of birth, physical addresses, and financial values (expressed in US dollars). Some entries contain multiple coordinates or addresses, while others include birthdates. This accumulation of data is significant, as isolated data points can already facilitate certain fraud attempts. Combining multiple data points allows for the construction of a much more detailed profile.

An email address can be used to send a phishing message mimicking a crypto exchange platform. A phone number can enable an attempt to impersonate an operator or be exploited to directly approach a target. A complete identity combined with a physical address allows for the relocation of the threat beyond the digital environment.

The addition of a financial estimate further enhances the value of the data. An attacker could theoretically sort people by their displayed amounts, select profiles they deem most profitable, and then enrich these profiles with other available data. The danger doesn't solely lie in a potential massive phishing campaign. Such a sale could be used as a reconnaissance tool.

In a more concerning scenario, the simultaneous presence of a home address and an estimated wealth provides the two essential elements of a physical targeting operation: where a person is located and how much an attacker believes they can extort.

ZATAZ cannot confirm that the 2.3 million entries are authentic, current, unique, or directly from a single compromise. The figure should be presented as a commercial claim. The structure of the sample also suggests that a single person may appear with multiple numbers or addresses, preventing the automatic assumption that 2.3 million lines represent 2.3 million distinct victims.

The origin of the file is also unknown. Nothing in the transmitted information allows for the establishment of whether it comes from a single hack, multiple leaks, a commercial enrichment, open sources, or an assemblage of data from different sources. This distinction is crucial. A data broker can give the impression of a massive recent leak, while the file may contain data from many older compromised databases.

A third announcement reveals a similar offering targeting American cryptocurrency investors, claiming 74,927 users linked to active cryptocurrency wallets. The announced format includes a pseudonym, email address, SOL balance, Ethereum address, DeBank portfolio estimate, and a status indicator. What’s interesting is the vendor’s “malicious marketing.” They claim to retain only active wallets and refer to a value between $600 and $13 million USD.

The base of 74,927 profiles is offered for $1,500. Again, the price doesn't allow for the conclusion of the content's authenticity. In cybercrime markets, an announcement can correspond to a real leak, a previously distributed compilation, partially false data, or a scam targeting other criminals. The last detail is that the same hacker is behind these three announcements, signing under different pseudonyms.

The interest in these announcements lies in their common logic. They don’t just sell contacts. They claim to link an identity or a contact method to observable financial activity. A connection that can transform digital information into a tool for selecting targets.

The context in France gives a particular dimension to this discovery by ZATAZ. The Ministry of the Interior has officially recognized the existence of attacks targeting crypto professionals and holders. On May 16, 2025, Bruno Retailleau mentioned “serial kidnappings” targeting crypto professionals and announced specific protection measures. This intervention follows several highly publicized cases in the spring of 2025 (such as the case of Pokémon card collectors). The Ministry is now meeting with actors in the crypto ecosystem, the police, and the police chief. Beauvau speaks of “kidnappings and extortion attempts of great violence” at this occasion.

It’s important to avoid confusion between institutional recognition and official statistics. The total depends on the scope chosen. Counting only completed kidnappings produces a different result than an inventory including attempts, detentions at home, and projects stopped before execution.

Among the cases recorded are Ledger in January, Troyes also in January, Paris on January 1st and 13th, two projects stopped in May, then Juvisy and Maisons-Alfort in June. Other cases appear in autumn and December. This chronology shows that events are not concentrated on a single episode. The phenomenon appears durable enough to affect specialized units.

The information report No. 813 of the Senate, deposited on July 2, 2025 by the finance committee, dedicated to elite police and gendarmerie units, provides an institutional source on this point. The document is based on the responses addressed to the rapporteur. Regarding the Brigade de recherche et d’intervention of the prefecture of police of Paris, it states: “In 2025, the BRI’s activity is reinforced on the occasion of kidnappings linked to cryptocurrencies.” This revelation confirms that the phenomenon has been taken seriously by this specialized police unit. Kidnappings linked to cryptocurrencies that even find an echo in a parliamentary report dedicated to the charges of elite units.

Another parliamentary source requests more caution. On February 10, 2026, Deputy Julie Lechanteux filed a written question addressed to the Minister of the Interior. She describes kidnappings, detentions, violence and threats against cryptocurrency holders and their families. Her text states: “In total, about sixty attacks have been recorded in 2025, marking a significant increase compared to forty cases recorded the previous year.” ZATAZ found this figure in the Official Journal of the National Assembly. It doesn’t mean that the Ministry of the Interior has recorded 60 attacks in France. The figure corresponds almost exactly to an international balance attributed to the private company TRM Labs. This balance reports about 60 “wrench attacks” against cryptocurrency holders worldwide in 2025, compared to about 41 in 2024. So, not just in France!”,