How a French Tax Worker Turned Crypto Databases into a Weapon for Violent Criminals

In France, what should have been just another internal government database query turned into the starting point for a violent home attack. A tax worker in Bobigny allegedly turned her access to state systems into a side business, compiling dossiers on targets ranging from cryptocurrency specialists to prison guards and a prominent billionaire. For crypto investors and policymakers, the case is a stark illustration of how public transparency rules and powerful state data systems can be repurposed into tools for physical coercion.

The Bobigny case: how an €800 payment unlocked a home attack

According to reporting cited in court documents, a tax administration employee in Bobigny used internal software to generate detailed files on a wide array of individuals: crypto specialists, billionaire Vincent Bolloré, prison staff, health inspectors, and even a judge. This was not a matter of idle curiosity. Investigators say she passed some of this information to criminals who paid her €800 to target a prison officer at home in Montreuil.

Her appeal was rejected on Jan. 6, as reported by local media, confirming the seriousness with which French authorities are treating the incident. But the real significance of the case lies less in the particular victim and more in the mechanism. The attackers did not need to hack an exchange, compromise a messaging app, or comb through leaked customer lists. They allegedly bought a lookup into state identity systems: tools that map names to precise home addresses, phone numbers, and family structures in a single query.

The tax databases she accessed are designed for legitimate purposes: collecting accurate returns, tracking capital gains, and ensuring people can be contacted by the administration. In practice, they give authorized staff the ability to reconstruct a granular portrait of anyone in the system—where they live, how their household is composed, and, critically, what kinds of assets they may hold.

In the Bobigny case, that capability appears to have been monetized. Investigators found search histories that extended well beyond the single prison officer who was attacked. The breadth of names—crypto specialists and high-profile figures like Bolloré—suggests a pattern of selling access, not a one-off vendetta. The €800 payment looks less like a bribe and more like a price point in an emerging underground service economy.

From tax records to targeting crypto holders: how state data became IRL MEV

France’s National Police Inspectorate has already started to track this behavior as a distinct problem. In 2024, it logged 93 investigations for violation of professional secrecy and 76 for “database diversion” inside public administrations. The agency describes the sale of government file lookups via social networks and the dark web as an “uberization” of data trafficking—a gig-economy model applied to sensitive information.

Separately, French broadcaster TF1 uncovered a Snapchat-based menu for exactly this trade. The list read like a price chart for an app-based service: €30 for a vehicle registration lookup, €150 to check whether someone appears in wanted-persons files, and €250 to illegally remove an immobilization order on a vehicle. Bank transfers linked to one suspect ranged from €15 to €5,000, showing that some buyers were paying significantly more for bespoke access.

For cryptocurrency investors, the relevance is direct. Crypto’s security model assumes that once keys are secured—ideally in hardware wallets or cold storage—the main risks are digital: phishing, malware, and exchange hacks. But as the Bobigny case illustrates, that model breaks down once attackers can resolve pseudonymous or semi-public identities into real-world homes using state data.

Once an attacker obtains a verified address, phone number, and a rough sense of household composition, “crypto security” becomes a coercion problem, not a cryptography problem. Some in the industry have started to frame this as maximum extractable value in real life, or IRL MEV. On-chain, maximal extractable value refers to miners or validators gaining an edge by seeing transactions first and reordering them. Offline, the equivalent is seeing the identity graph first—understanding who lives where, who likely holds what—and selecting the cheapest path to force a transfer.

In that framework, the state database is the vantage point. It lets insiders convert routine administrative records into a targeting feed. That is particularly attractive when those records include indicators of crypto wealth, such as capital gains filings or repeated declarations from high-value trading activity.

France’s transparency template: address suppression on the front end, exposure in the back end

Rising attacks have already pushed French authorities to modify how public registries handle sensitive information. In December, French outlet Le Parisien reported that assaults on crypto investors had multiplied, prompting the government to issue a decree in August 2025 to remove home addresses of crypto business leaders from the RCS commercial registry.

The RCS, via its Kbis documents, previously displayed company directors’ personal home addresses in filings accessible to anyone. For attackers trying to map business activity to physical locations, this was a near-frictionless route. The August decree closed that particular hole by suppressing those addresses from public view, with the explicit aim of reducing risks of physical aggression and harassment.

However, law enforcement, customs officials, and the tax administration still have full access to those same details. And tax systems go further than what registries ever showed. Tax databases are continuously updated through annual returns. Addresses are refreshed when people move. Phone numbers surface in correspondence. Family structures emerge from declared dependents. Capital gains filings link specific asset classes—including crypto—to individual taxpayers.

TF1’s reporting confirms that French tax employees can see this entire picture. That access is by design; the system needs it to administer the tax code. But when even a tiny fraction of insiders choose to monetize their credentials, the result is a scalable attack surface. A single lookup costs tens or hundreds of euros in the underground market, while a successful violent home invasion targeting a crypto holder can yield five or six figures in transferable assets.

The European Union Agency for Cybersecurity (ENISA) recorded 586 security incidents affecting EU public administrations in 2024. While that figure includes a range of digital threats like DDoS attacks, the Bobigny case underlines a different vector: not sophisticated external hackers, but insiders with legitimate credentials extracting data for secondary markets.

For policymakers, this is the crux of the dilemma. On one side, registries like the RCS are being locked down for safety reasons. On the other, richer, more centralized datasets inside tax and law-enforcement systems are expanding as states demand more detailed disclosures, including on digital assets.

The regulatory paradox: anti-evasion rules as honeypots for coercion

That tension is likely to intensify. European authorities have been steadily expanding crypto transparency requirements in the name of combating money laundering and tax evasion. Mandatory know-your-customer checks, reporting obligations for wallet providers, and efforts to track DeFi activity all point toward more comprehensive maps connecting individuals to their on-chain behavior.

The Bobigny case demonstrates the downside of this approach when physical safety is factored into the threat model. The more complete and precise these mappings become, the more attractive they are to anyone who can access them—legitimately or otherwise. A registry that connects identity, address, and asset holdings is not just a compliance tool; in the wrong hands, it is a targeting list.

France’s proposed 2026 budget crystallizes that risk. The plan includes a 1% annual tax on crypto holdings above €2 million. To enforce such a measure, the state would require declarations that cover self-custodied and offshore-held assets, aggregating them into a centralized record of high-net-worth crypto holders, along with their contact and residential details.

From a revenue perspective, that is logical. From a security perspective, it creates a honeypot: a curated database of exactly the people most worth targeting for physical coercion. Unlike bank accounts or brokerage portfolios, the assets at stake are often controlled directly by the individuals in question.

Banks can freeze accounts in response to suspected coercion or fraud. Brokerage transfers can be reversed under certain conditions. Crypto transfers are inherently final. Once a private key has been used to sign a transaction sending funds away, or once a seed phrase is disclosed, there is no centralized authority capable of undoing the move.

This finality shifts the risk surface. Traditional financial crime models focus on preventing or reversing unauthorized transactions within an institution. In self-custodied crypto, there is no such institution. The point of failure becomes the person—specifically, their identity and location. Once that information is reliably known to attackers, coercion becomes the cheapest and most efficient attack vector.

Inside the ‘uberization’ of government data: a commodity market for identity

The French police inspectorate’s term “uberization” captures how far this has already progressed. Illicit database access is no longer an ad hoc favor among acquaintances; it is a product with clear pricing, distribution channels, and repeat customers.

The Snapchat price list uncovered by TF1—€30 for a vehicle registration lookup, €150 for wanted-persons checks, €250 to un-immobilize a vehicle—shows how granular these offerings have become. Each item is a discrete service, purchased on demand. The bank transfers from €15 to €5,000 linked to one suspect suggest that some buyers may be paying bulk or premium rates for more detailed or urgent data pulls.

The sellers, for their part, are not underground hackers. They are employees with authorized access who recognize a simple arbitrage: the marginal cost of a lookup to them is zero, while market demand is willing to pay substantial sums. Detection often depends on post-facto anomaly analysis and investigations, which means that as long as insiders stay below certain thresholds or spread out their activity, they may perceive the personal risk as manageable compared to the financial reward.

Current countermeasures—disciplinary action, criminal prosecution, and periodic audits—address individual cases but do not fundamentally change the underlying economics. The data remains centralized and extremely valuable. Access rights must be broad enough for the state to function. That leaves a wide pool of potential insiders whose decisions determine whether the system operates securely or becomes an attack-enabling infrastructure.

For crypto holders, the implication is that disintermediation has limits. Removing banks and other custodians protects against seizure and censorship. It does not protect against someone arriving at your home with knowledge sourced from a government database. In fact, the very features that make crypto attractive—irreversibility, self-custody, and portability—can increase the payoff for attackers once they have a reliable address and a plausible reason to believe assets are present.

What this means for crypto security, policy, and personal risk

The Bobigny case offers a clear lesson: in a world where states demand detailed, centralized records of who owns what, the physical threat to those owners becomes part of the security equation. Key management and hardware wallets remain essential for resisting digital attacks, but they do little when the primary vulnerability is that someone with a badge can sell your address to a violent gang.

From a policy standpoint, the trajectory of reforms in France suggests a gradual recognition of this problem. Suppressing home addresses of crypto business leaders in the commercial registry is one attempt to limit public exposure. Tracking “database diversion” as a separate investigative category is another sign that authorities understand insider abuse is not a theoretical risk but a recurring pattern.

Yet the broader paradox remains unresolved. Efforts to enhance transparency for tax and anti-money laundering purposes necessarily consolidate sensitive data. The more complete the dataset, the more attractive it is to insiders willing to monetize it and to criminals willing to pay. As long as those incentives persist, isolated prosecutions may have limited deterrent effect.

For investors and entrepreneurs in the crypto sector, this argues for thinking about security across three layers:

• On-chain security: robust key storage, hardware wallets, and secure transaction practices.
• Identity exposure: minimizing unnecessary public links between personal addresses and crypto activities where regulations allow, and understanding where mandatory disclosures create unavoidable footprints.
• Policy risk: evaluating how national reporting rules, wealth declarations, and registry practices could translate into personal targeting risk, especially when combined with insider access to state systems.

None of these layers can be addressed by individuals alone. System-level choices—how many officials can query certain databases, how access is logged and audited, and how much financial and personal data must be centralized in the first place—will shape the real-world risk environment for crypto holders.

What the Bobigny incident ultimately reveals is not a single rogue employee, but a structural vulnerability at the intersection of crypto, taxation, and state data. As France debates measures like a 1% annual tax on large crypto holdings, the question is no longer just how to track and tax digital assets. It is how to do so without turning compliance records into roadmaps for real-world violence.