Hackers fuel panic with claims linking crypto data leak to recent kidnappings in France
France has seen a series of high‑profile crypto-related kidnappings and extortions in recent months, while the crypto tax platform Waltio recently confirmed a data breach. Hackers are now claiming a link between the two, sparking fear online.
Over 5,000 French crypto holders have been exposed on the dark web since at least December 24, 2025, when dark web intelligence firm Brinztech disclosed findings about a potential data breach at Waltio, a prominent French cryptocurrency tax filing platform.
Sensitive personal information was allegedly exposed: names, surnames, email addresses, phone numbers, and tax residency status.
A few weeks later, French media reported that an entire family was kidnapped and held hostage by five people, seeking to extract access to cryptocurrency. According to ouest-france.fr, it’s one of three recent cases investigated by prosecutors and linked to violent cryptocurrency extortion cases.
One crypto investor and his wife were kidnapped on the night of December 18th, 2025, and forced to make transfers of nearly eight million euros ($9.5 million), according to franceinfo.fr.
Now, hackers are disseminating claims that the recent kidnappings are related to the Waltio breach.
“I wish to report serious incidents that have occurred in the last 5-6 months in France, involving three victims who were kidnapped from their homes and had large sums of money stolen,” a threat actor posted anonymously on the illicit marketplace BreachForums, addressing the authorities.
“It is important to note that these criminal acts seem to be related to the illegal exploitation of a database from Waltio.”
According to the hacker’s post, the three kidnappings netted criminals $9.3 million, $3.8 million, and $4 million, respectively.
The threat actor also appears to accuse another cybercrime group, Crimson Collective, of being responsible for the crimes and betraying them, prioritizing money over “the heart of a human, friendship, and trust.”
The author acknowledged collaborating with Crimson Collective to compromise the database, claiming the group promised “15% of their gain.” The hacker is now threatening to expose the group for scamming them, setting a three-day countdown that expires on February 10th, 2026.
Personal data can lead to real-world kidnapping
This dispute among cybercriminals is fueling concerns among crypto enthusiasts on social media.
“If these claims were confirmed, it would far exceed the realm of mere cybercrime: leaks of personal data could be used to identify, locate, and target individuals for real-world kidnappings and extortion. A chilling scenario that illustrates just how far data breaches can go when they fall into the wrong hands,” a translation of one French user’s post reads
Coincidentally, on Friday, French police arrested six people, including a minor, suspected of a cryptocurrency-linked kidnapping of a magistrate and her 67-year-old mother, who were injured and held for 30 hours but freed themselves without a ransom being paid, Le Monde reports.
Cybernews researchers warn that leaked information could compromise physical security.
“Having information like crypto balances would allow attackers to target wealthy users. Email addresses could be used to perform an OSINT investigation on the target to dig up other personal details, such as where they live or work,” said the researchers.
However, anonymous threat actors didn’t provide any proof linking the Walio leak to the recent violent crimes in France.
“It’s just an angry post from a hacker about being scammed, and they want to discredit the party that wronged them, potentially banning them from the forum. ShinyHunters is attributed to the Waltio breach and extortion,” the researchers noted. “The database was posted for sale on a forum on December 24, 2025, meaning it was stolen earlier. It could have been shared in private circles at the time.”
Cryptocurrency-related physical attacks are not new in France, and the country has been suffering a wave of violent extortion attempts throughout 2025 and earlier. In May last year, French police arrested around twenty people suspected of being involved in a recent spate of kidnappings of cryptocurrency holders, according to Euronews.
In January last year, kidnappers seized the French crypto boss David Balland, co-founder of Ledge, cut off his finger, and demanded a hefty ransom, the Guardian reported.
What do we know about the Waltio breach?
The company did not address any breach claims until a month later. On January 23rd, 2026, Waltio released a statement informing about the incident it had detected two days earlier.
French cybercrime authorities informed about the preliminary investigation a day earlier.
“On the night of January 21, 2026, we were informed of a particularly sophisticated attack from a malicious actor claiming to hold data from our users and providing a sample to verify its authenticity,” the Waltio statement reads.
Waltio confirmed that the exposed data “concerns a limited scope related to the generation of 2024 tax reports,” and contains users’ email addresses, aggregated data from the tax reports, including gains or losses, and balances. The leaked information is more limited for users who did not complete tax reports.
The company assured that the leak did not affect passwords, wallet addresses, transaction history, or other financial information, and warned that the main risks are targeted scams and phishing.
“Waltio services are operating normally; user accounts and the production infrastructure are secure.”
However, the Brinztech report warned users of potential physical and digital extortion a month ago.
Cybernews reached out to Waltio for a comment on the recent claims by threat actors and will include their response.
Authorities in France warn crypto users that attackers may use leaked information to launch phishing and social engineering scams impersonating fake support agents, bank fraud departments, or law enforcement.
Unlock more exclusive Cybernews content on YouTube.
