A French tax agent, identified as Ghalia C. in French media reports, has been accused of accessing and selling sensitive information from internal French tax authority databases. Criminals are said to have then used this data in at least one violent home assault on a prison officer and his wife, stemming from a dispute over smuggled mobile phones in a prison cell. 

Ghalia also queried details on those known to be involved with crypto who would be suspected of having substantial holdings of digital cash, potentially setting them up for “$5 wrench attacks” where thieves use physical force to force irreversible transfers of bitcoin, stablecoins, or other types of digital assets. In addition to traditional crypto hacking and thefts over the internet, such as a recent example where an Office Space-style exploit was used, physical attacks on crypto users, where transfers are forced under threat or use of violence, are becoming increasingly common.

The tax agent in question recently lost an appeal and will remain in custody after a hearing at France’s appellate court. She admitted providing the data but insisted she was unaware of the buyers’ plans. In an English translation from French reports, she stated, “I gave information about this person. I knew nothing of what was done and I would like to ask forgiveness from this couple who were attacked.”

Prosecutors noted her refusal to unlock her phone or name her sponsor, arguing she abused her role to aid a repeat offender. Beyond crypto users and the prison guard who was the victim of a home invasion, Ghalia allegedly sold details on health inspectors, a judge, and billionaire Vincent Bolloré.

2025 marked an all-time record in terms of physical crypto thefts, and a substantial number of these attacks have occurred in France. For example, there was the abduction of David Balland, who is a co-founder of crypto hardware wallet manufacturer Ledger, and his partner, who were held for ransom tied to their crypto assets. Additionally, kidnappers targeted the father of a prominent crypto entrepreneur and went as far as to sever a finger in a ransom scheme, but police intervened and rescued him.

Of course, these threats extend beyond France, as seen in a San Francisco home invasion late last year where an attacker disguised as a delivery driver entered a Mission Dolores residence in broad daylight, pulled a gun, duct-taped the victim, and coerced the transfer of $11 million in crypto.

While 2025 set records for crypto’s role in broader illicit flows, which blockchain analytics firm Chainalysis says reached $154 billion in transactions to illicit addresses, Ghalia took payments through traditional means via bank cash deposits and Western Union transfers. 

No reports directly link Ghalia’s data sales to one of the specific crypto thefts that took place in France last year, but this case underscores how casual handling of personal information clashes with the reality of irreversible payments of digital cash. And this juxtaposition between crypto and personal data security is increasingly put on display in more cases, as also illustrated by the case of the data breach at a third-party payment processor used by Ledger reported earlier this week.

Crypto enables full financial self-custody, yet sensitive data remains vulnerable in centralized databases and has not seen a similar upgrade towards a more decentralized infrastructure. Bitcoin advocates and cypherpunks have consistently flagged government and institutional personal data processing and storage mandates as major opsec risks. Unfortunately, widespread data mishandling may persist until more breaches lead to a push for a new paradigm of individually-controlled data as opposed to government and corporate-controlled honeypots.