David Bennett warns French tax leak exposes crypto owners
- Hacker zero bytes leaked 678,000 French tax records, exposing crypto owners to targeted physical attacks.
- Third-party shipping leaks from hardware wallet vendors create physical targets for home extortion.
- Security experts urge purchasing custody hardware in person with cash or using proxy shipping addresses.
A hacker breached French tax infrastructure and published 678,000 citizen records online.
The leak hit the French tax administration, known as the DGFIP. Hacker zero bytes extracted full names, physical home addresses, income tiers, and tax correspondence. For citizens who disclosed cryptocurrency holdings to tax authorities, the breach maps wealthy self-custody holders straight to their front doors.
On Bitcoin And, host David Bennett warned that releasing tax profiles alongside home addresses creates an immediate physical safety risk. Bitcoin developer Jameson Lopp tracks France as a global epicenter for wrench attacks, where criminals use physical violence and home invasions to extort private keys.
Physical security risks extend beyond state databases. Days earlier on August 15, news surfaced that a logistics partner breach exposed shipping records for over 11,000 Trezor hardware wallet customers. That leak exposed buyer names, phone numbers, and home addresses, linking self-custody hardware ownership directly to residential locations.
On Ungovernable Misfits, co-host Max advised Bitcoiners to avoid shipping hardware directly to primary residences. He urged buying hardware in person at conferences using cash or Lightning, or routing online deliveries to postal boxes and FedEx hold locations to sanitize physical logistics.
The supply chain vulnerabilities coincided with critical software bugs in self-hosted infrastructure. A flaw in BTCPay Server exposed LND authentication macaroons, giving remote attackers administrative control over node funds. Cake Wallet COO Seth noted that attackers obtaining those macaroons could force channel closures and sweep funds instantly.
To prevent external data leaks during development, self-custody projects are shifting toward local infrastructure. Seth detailed how Cake Wallet deployed NVIDIA DGX Spark units to run open-weight AI models locally, performing code audits and vulnerability scans without exposing sensitive repositories to third-party cloud servers.
Protecting private keys now requires defending physical home addresses with equal rigor.