90 cryptocurrency-related attack cases occurred within 7 months.

Written by: Christina Comben

Translated by: Chopper, Foresight News

Official records from France show that in just over 7 months, there were 90 cryptocurrency-related cases locally, involving kidnapping, extortion, personal threats, and violent robbery. According to the French Ministry of the Interior, from January 1, 2026, to mid-August, the police arrested a total of 223 people, with 126 of those involved sentenced to prison.

This translates to approximately one new case every 2.5 days. However, there is no comparative data available from last year, so it is difficult to determine if the situation has suddenly worsened. The Ministry of the Interior stated: "We do not have statistics for similar cases in 2025; the registration of such incidents officially began on January 1, 2026."

The impact of this new data is stronger, far exceeding the number of offline violent attacks reported by other public institutions.

Chainalysis data reveals that, as of mid-2026, there were 30 publicly recorded “ransom attacks” in France, but the agency pointed out that the real scale “is definitely larger.” Statistics from the security agency gart.io show that there have been 73 attacks in France this year so far, ranking first in the world, followed by 66 in the US and 27 in the UK.

The rising number of offline violent attacks targeting cryptocurrency holders (commonly known as ransom attacks) is not just a collection of isolated cases; leaked personal data is likely the main culprit.

Why France?

Ransom attacks are not a new phenomenon. Bitcoin security researcher Jameson Lopp has been compiling a public database of offline attack cases for years, recording 365 incidents across 60 countries from 2014 to 2026, with France ranking first.

However, the new change is that violent crypto crimes are spreading rapidly within France. Chainalysis information indicates that attacks have occurred in various locations, including Strasbourg, Marseille, Grenoble, Toulouse, and Nantes.

The number of recent violent attack incidents is higher than the historical average. Data source: Chainalysis

The criminals' targets are not foreign tourists holding crypto assets; among known victims with residential addresses, 93% are local French citizens.

Eric Jardine, chief researcher at Chainalysis, told Cointelegraph in an interview that the surge in cases is “highly likely” driven by a significant data breach. “Such breaches not only leak financial information but also expose who holds cryptocurrency, their addresses, and how to find them.”

This makes offline attacks targeting cryptocurrency holders particularly dangerous. Criminals may not even need to show up with a wrench demanding mnemonic phrases and coercing transfers; the attack begins before they arrive. Criminals first need to identify their targets: who owns valuable assets, where they live, and how to find them.

Jardine mentioned that a data leak incident occurred in 2024 involving the French tax authorities, where a tax official in the Paris region leaked the personal identification information, financial data, and records of crypto asset holdings of French taxpayers, which fueled the outbreak of cases. Chainalysis records show that the number of attack cases began to soar from late November of the same year.

Chainalysis also noted another incident in January 2026: a data leak at the crypto tax reporting service provider Waltio, which again provided criminals with a wealth of usable information to target individuals.

Francis Pouliot, the founder of Canadian bitcoin exchange Bull Bitcoin, has repeatedly questioned Europe’s DAC8 cryptocurrency reporting rules in France; this rule has expanded tax reporting and information-sharing requirements for EU cryptocurrency users. He stated that DAC8 has turned “Know Your Customer (KYC)” into “Kill Your Customer,” referring to France as the “global capital of crypto kidnappings.”

Statistics on the number of cryptocurrency ransom attacks in various countries

The target is not necessarily the bitcoin holder themselves

Chainalysis data shows that an emerging trend is the changing nature of attack targets. By early 2026, relatives and acquaintances accounted for about 25%-30% of global crypto violence cases; in France, this proportion exceeds 40%.

In May 2026, six suspects attempted to kidnap Sébastien Borget's wife in Villeneuve, France. One of the attackers disguised as a delivery person tricked the victim into opening the door.

In August, a couple in rural France experienced three attempts of burglary. The property they purchased previously belonged to a crypto asset tycoon. The former owner's tax information and address were leaked to the dark web, leading criminals to show up multiple times.

A similar case occurred in 2025 when the father of a crypto entrepreneur was kidnapped. The kidnappers allegedly cut off part of his finger and sent it to his son, demanding a ransom of $5.6 million in cryptocurrency.

Jardine noted that the phenomenon of attacking relatives and associated individuals indicates that criminals conduct thorough reconnaissance before their actions, using means such as monitoring social media, analyzing on-chain data, utilizing leaked information, or obtaining clues from insiders.

This shatters the common perception of crypto attacks: the holder of the wallet themselves might not be the person the criminals are seeking.

The French authorities classify such attacks as organized crime and have consolidated investigations through a specialized organized crime judicial body, JUNALCO.

The $5 wrench dilemma

The majority of cryptocurrency holders understand the importance of protecting their mnemonic phrases, using hardware wallets, conducting environmental testing, and avoiding phishing links.

These protective measures still matter. But if criminals already know your identity, address, and confirm that you hold valuable assets, all of the above defenses will be rendered ineffective.

Cryptography can protect wallets, but it cannot stop attackers with a $5 wrench.