French Authorities Probe Waltio Data Breach Affecting 50,000 Crypto Users French authorities have opened an investigation into a data breach at Waltio, a crypto tax platform, after hackers exposed the personal information of approximately 50,000 users, most of whom are based in France. The breach, attributed to the hacker group Shiny Hunters, involved the theft of sensitive data, which the group later attempted to monetize through a ransom demand. Officials warn that the stolen information could be exploited for malicious activities, including targeted attacks on crypto holders. Among the primary concerns are "wrench attacks" a form of extortion where criminals use threats or physical coercion to force victims into transferring digital assets. Cybersecurity authorities have highlighted the risk of kidnapping or unlawful detention as potential consequences for affected users. The incident has intensified scrutiny of crypto tax platforms like Waltio, which have grown in prominence due to new EU regulations requiring detailed reporting of users' crypto holdings. The DAC-8 proposal, which mandates disclosure of even inactive assets, has increased the volume of sensitive data stored by such platforms, making them attractive targets for cybercriminals. Authorities are examining possible connections between the Waltio breach and other recent attacks on crypto holders, suggesting the stolen data may already be in use for fraudulent purposes. The investigation remains ongoing.

French Crypto Tax Platform Waltio Investigated After Data Breach Exposes 5,000 Users On December 24, 2025, dark web intelligence firm Brinztech identified a database containing the personal data of approximately 5,000 French cryptocurrency holders listed for sale. The exposed information, linked to crypto tax platform Waltio, reportedly included emails and summary details from 2024 tax reports but no passwords, wallet addresses, or banking data were compromised. French authorities launched an investigation following the breach, with the Paris Prosecutor’s cybercrime unit assigning the case to France’s National Cyber Unit. The probe aims to determine the full scope of the stolen data and identify affected users. Waltio confirmed the incident in a January 23, 2026, security notice, acknowledging an extortion attempt received two days prior. The company filed a criminal complaint for unauthorized system access and attempted extortion, describing the attack as "particularly sophisticated." The breach has raised concerns beyond digital security. French authorities issued warnings about criminals impersonating law enforcement to target victims, emphasizing that police will never request confidential data by phone or appear unannounced at residences. The alert follows a surge in physical attacks on crypto holders, including a January 14 kidnapping of a retired couple in Sallanches and a foiled abduction attempt in Paris on January 23. Waltio maintains that the exposed data was limited to emails and tax report summaries, though Brinztech’s initial report suggested the dark web listing included names and phone numbers information Waltio claims it does not collect. The discrepancy remains unresolved, and it is unclear whether the December dark web listing is directly tied to the January extortion attempt. Waltio has notified France’s data protection authority (CNIL) and advised users to verify security codes in official communications. The incident underscores the risks faced by crypto tax platforms, which handle sensitive transaction data under international reporting requirements. It also follows a separate January 2026 breach at French hardware wallet maker Ledger, highlighting growing cybersecurity threats in the sector. Investigations into the Waltio breach are ongoing.