A tax worker in Bobigny used inside software program to compile dossiers on cryptocurrency specialists, billionaire Vincent Bolloré, jail guards, and a decide. She handed the knowledge to criminals who paid €800 to assault a jail officer at house in Montreuil.
Her enchantment was rejected Jan. 6, as reported by native media.
The case issues much less for what occurred than for the way targets have been chosen. The latest vector is not Telegram doxxing or compromised exchanges. It is privileged entry to state identification techniques that map names to addresses, telephone numbers, and household constructions with a single question.
France’s Nationwide Police Inspectorate logged 93 investigations in 2024 for violation {of professional} secrecy and 76 for database diversion. The company calls the sale of presidency database lookups through social networks and darkish internet an “uberization” of file trafficking.
A separate TF1 investigation uncovered a Snapchat-based service menu: €30 for a car registration lookup, €150 for a wanted-persons file verify, and €250 for an unlawful car un-immobilization. Financial institution transfers related to at least one suspect ranged from €15 to €5,000.
Crypto’s safety mannequin assumes irreversibility, and self-custody eliminates the danger of intermediaries. Nonetheless, as soon as an attacker obtains a real-world identification, the “crypto half” turns into a coercion downside relatively than cryptography.
Consider it as most extractable worth in actual life, or IRL MEV. When on-chain, maximal extractable worth comes from seeing transaction stream first. In bodily house, attackers extract worth by first observing the identification graph after which selecting the most cost effective coercion path.
France constructed the template
Le Parisien reported Dec. 18 that assaults on crypto traders have multiplied, prompting the French authorities to challenge an August 2025 decree eradicating house addresses of crypto enterprise leaders from the RCS industrial registry.
The measure protects in opposition to bodily aggression and harassment, although legislation enforcement, customs, and tax administration retain entry.
The RCS beforehand displayed enterprise leaders’ house addresses on Kbis paperwork, that are publicly accessible company filings. The August decree closed one gap, however tax administration databases stay open to 1000’s of civil servants, and oversight depends on post-facto anomaly detection.
Tax techniques include granular knowledge. Addresses replace with returns. Cellphone numbers seem on correspondence. Household construction exhibits by way of dependent declarations. Capital good points filings map asset courses to people.
TF1 reported that French tax databases give workers entry to all of this.
The unit economics favor attackers: a lookup prices tens to lots of of euros, and a profitable house invasion yields no less than 5 or 6 figures.
ENISA tracked 586 incidents affecting EU public administrations in 2024. The risk mannequin is not refined hacking, however insiders with professional credentials extracting knowledge for secondary markets.
Ghalia C. admitted to passing data to 3 males who attacked a jail officer. The €800 cost suggests a service transaction. Her search historical past prolonged to crypto specialists, billionaire Bolloré, well being inspectors, and judges. This means she was promoting entry, not executing a single vendetta.
Crypto holders current an unusually favorable risk-return profile for bodily coercion.
Belongings are self-custodied, so no financial institution freeze or court docket order can reverse a coerced switch. Moreover, victims usually maintain vital worth that may be moved immediately. And reporting exposes them to tax scrutiny they might have been avoiding.
The coverage change eradicating enterprise leaders’ addresses from public registries indicators institutional recognition that crypto-related bodily dangers function otherwise.
Banks can freeze accounts. Brokerage transfers could be reversed. Crypto transfers are ultimate.
That finality shifts the risk panorama from technical safety to identification safety. As soon as attackers resolve the identification downside, coercion is simple.
The chokepoint moved
If identification knowledge is a scarce useful resource, count on three responses.
First, extra registry confidentiality, with the RCS deal with suppression changing into a template.
Second, hardened controls inside authorities techniques. France’s IGPN already tracks database diversion as a definite class.
Third, continued insider-plus-access-for-sale incidents, as unit economics stay favorable.
The Bobigny case highlights a regulatory paradox. European authorities are increasing crypto transparency by way of necessary KYC, wallet-provider reporting, and DeFi transaction monitoring to fight cash laundering and tax evasion.
These necessities create centralized databases mapping identities to holdings. The extra complete the database, the extra beneficial it turns into to attackers.
France’s proposed 2026 finances features a 1% annual tax on crypto holdings exceeding €2 million, requiring self-custodied and offshore holdings to be declared. The coverage creates a honeypot: a government-maintained record of high-net-worth crypto holders, together with their addresses.
The technical neighborhood frames crypto safety as key administration, and that is true for on-chain assaults. But the Bobigny case demonstrates that key administration is irrelevant as soon as bodily coercion is launched into the risk mannequin.
Seed phrases saved in {hardware} wallets do not assist when attackers know your deal with and arrive with weapons. The safety failure occurred upstream, within the identification layer.
Service financial system has already fashioned
The “uberization” framing from France’s police inspectorate is exact.
Database lookups are bought like commodities, with clear pricing. The Snapchat value record of €30 for car registration and €150 for wanted-persons checks exhibits the market is productized.
Sellers are workers with professional entry who acknowledge the arbitrage: lookups value them nothing, consumers pay lots of, and the danger of detection is low.
What’s lacking from countermeasures is an financial mannequin that matches the attacker’s unit economics. France can prosecute particular person instances, however the underlying incentive construction of low-cost entry to beneficial identification knowledge stays intact.
The RCS deal with suppression helps at margins. However it would not deal with the 1000’s of presidency workers who’ve professional entry to tax, legislation enforcement, and judicial databases that include all the pieces an attacker wants.
Crypto’s promise is disintermediation. No banks, no gatekeepers, no trusted third events. That mannequin works for censorship resistance and seizure safety.
It fails when the risk is bodily coercion enabled by authorities identification techniques.
The Bobigny case makes seen a market construction that often operates invisibly. Targets do not know they have been seemed up till attackers arrive.
