French crypto tax platform Waltio is under investigation following a major data breach that has put tens of thousands of users at risk of scams and physical threats.
Quick Summary – TLDR:
- Waltio confirmed hackers accessed user emails and tax summary data for 2024 reports.
- At least 50,000 users are affected, with rising risks of phishing and impersonation scams.
- French authorities launched a formal investigation, linking the breach to a spike in crypto-related kidnappings.
- The hacking group Shiny Hunters is suspected and has reportedly attempted extortion.
What Happened?
French authorities have launched an investigation into a data breach at Waltio, a crypto tax reporting platform popular in France and Belgium. The breach, first discovered in January 2026, has exposed sensitive user data and raised alarms over a wave of targeted scams and attempted kidnappings of cryptocurrency holders.
NEW: FRENCH CRYPTO TAX REPORTING AND PORTFOLIO MANAGEMENT TOOL WALTIO TARGETED IN EXTORTION AND DATA BREACH; NEARLY 50K USERS POTENTIALLY AFFECTED – LE PARISIEN
— DEGEN NEWS (@DegenerateNews) January 23, 2026
SOURCE: https://t.co/pK6mBNYxO3 pic.twitter.com/Flszt1z5KK
French Government Investigates as Crypto Crimes Surge
The Paris Public Prosecutor’s cybercrime division and France’s National Cyber Unit are actively investigating the Waltio data breach. A government alert confirmed a preliminary investigation is underway, with concerns that criminals are exploiting leaked data to impersonate police officers and manipulate victims into surrendering control of their crypto assets.
- The breach affects approximately 50,000 Waltio users.
- Hackers gained access to email addresses and summarized data from 2024 tax filings.
- No passwords, wallet addresses, or bank data were compromised, Waltio says.
- The attack is described as highly sophisticated by the company and investigators.
Company Responds Amid Extortion and Scam Threats
Waltio CEO Pierre Morizot confirmed that the company received an extortion attempt on January 21, when hackers threatened to release stolen data. Waltio later filed a criminal complaint for unauthorized access and attempted extortion and began working closely with authorities.
Waltio emphasized that:
- The breach did not affect user login credentials or crypto wallet keys.
- Social engineering scams are now the primary risk, where attackers may use details like the existence of a tax report to appear legitimate.
- Users should verify the security code in official Waltio emails to guard against phishing.
Morizot warned:
Breach Timeline and Possible Dark Web Listing
Cybersecurity firm Brinztech first spotted what it claimed was a Waltio database for sale on the dark web on December 24, 2025. However, Waltio said it only became aware of the breach through the January extortion attempt.
Interestingly:
- Brinztech reported the dark web listing included names and phone numbers, which Waltio insists it does not collect.
- This discrepancy raises questions about whether the data set seen in December is the same one hackers used in January.
Physical Threats and Kidnapping Fears
French authorities are not just worried about digital theft. A security bulletin issued by the government warned that the breach could lead to physical threats, including impersonation by fake officers and kidnapping attempts.
- On January 14, a retired couple was kidnapped in Sallanches, reportedly for their crypto assets.
- Another kidnapping attempt was foiled in Paris on January 23.
- Hardware wallet company Ledger, also based in France, experienced its own breach earlier in January.
These incidents suggest a disturbing trend in France, where crypto ownership is now being exploited both digitally and physically.
SQ Magazine Takeaway
This Waltio breach is a chilling reminder that crypto security is not just about passwords and hardware wallets. It is now about personal safety. As someone who closely watches crypto developments, this story feels especially urgent. The idea that data from a tax platform could lead to real-world danger is not just troubling, it’s outrageous. Platforms handling financial data must do better, and users need to stay extra cautious. I’d recommend anyone impacted to change communication habits, verify identities of all requests, and never trust unsolicited calls or emails. This isn’t just a breach. It’s a wake-up call.
