A tax employee in Bobigny used internal software to compile dossiers on cryptocurrency specialists, billionaire Vincent Bolloré, prison guards, and a judge. She passed the information to criminals who paid €800 to attack a prison officer at home in Montreuil.
Her appeal was rejected Jan. 6, as reported by local media.
The case matters less for what happened than for how targets were selected. The newest vector isn’t Telegram doxxing or compromised exchanges. It’s privileged access to state identity systems that map names to addresses, phone numbers, and family structures with a single query.
France’s National Police Inspectorate logged 93 investigations in 2024 for violation of professional secrecy and 76 for database diversion. The agency calls the sale of government database lookups via social networks and dark web an “uberization” of file trafficking.
A separate TF1 investigation uncovered a Snapchat-based service menu: €30 for a vehicle registration lookup, €150 for a wanted-persons file check, and €250 for an illegal vehicle un-immobilization. Bank transfers connected to one suspect ranged from €15 to €5,000.
Crypto’s security model assumes irreversibility, and self-custody eliminates the risk of intermediaries. However, once an attacker obtains a real-world identity, the “crypto part” becomes a coercion problem rather than cryptography.
Think of it as maximum extractable value in real life, or IRL MEV. When on-chain, maximal extractable value comes from seeing transaction flow first. In physical space, attackers extract value by first observing the identity graph and then choosing the cheapest coercion path.
France built the template
Le Parisien reported Dec. 18 that attacks on crypto investors have multiplied, prompting the French government to issue an August 2025 decree removing home addresses of crypto business leaders from the RCS commercial registry.
The measure protects against physical aggression and harassment, though law enforcement, customs, and tax administration retain access.
The RCS previously displayed business leaders’ home addresses on Kbis documents, which are publicly accessible corporate filings. The August decree closed one hole, but tax administration databases remain open to thousands of civil servants, and oversight relies on post-facto anomaly detection.
Tax systems contain granular data. Addresses update with returns. Phone numbers appear on correspondence. Family structure shows through dependent declarations. Capital gains filings map asset classes to individuals.
TF1 reported that French tax databases give employees access to all of this.
The unit economics favor attackers: a lookup costs tens to hundreds of euros, and a successful home invasion yields at least five or six figures.
ENISA tracked 586 incidents affecting EU public administrations in 2024. The threat model isn’t sophisticated hacking, but insiders with legitimate credentials extracting data for secondary markets.
Ghalia C. admitted to passing information to three men who attacked a prison officer. The €800 payment suggests a service transaction. Her search history extended to crypto specialists, billionaire Bolloré, health inspectors, and judges. This indicates she was selling access, not executing a single vendetta.
Crypto holders present an unusually favorable risk-return profile for physical coercion.
Assets are self-custodied, so no bank freeze or court order can reverse a coerced transfer. Additionally, victims often hold significant value that can be moved instantly. And reporting exposes them to tax scrutiny they may have been avoiding.
The policy change removing business leaders’ addresses from public registries signals institutional recognition that crypto-related physical risks operate differently.
Banks can freeze accounts. Brokerage transfers can be reversed. Crypto transfers are final.
That finality shifts the threat landscape from technical security to identity security. Once attackers solve the identity problem, coercion is straightforward.
The chokepoint moved
If identity data is a scarce resource, expect three responses.
First, more registry confidentiality, with the RCS address suppression becoming a template.
Second, hardened controls inside government systems. France’s IGPN already tracks database diversion as a distinct category.
Third, continued insider-plus-access-for-sale incidents, as unit economics remain favorable.
The Bobigny case highlights a regulatory paradox. European authorities are expanding crypto transparency through mandatory KYC, wallet-provider reporting, and DeFi transaction tracking to combat money laundering and tax evasion.
Those requirements create centralized databases mapping identities to holdings. The more comprehensive the database, the more valuable it becomes to attackers.
France’s proposed 2026 budget includes a 1% annual tax on crypto holdings exceeding €2 million, requiring self-custodied and offshore holdings to be declared. The policy creates a honeypot: a government-maintained list of high-net-worth crypto holders, including their addresses.
The technical community frames crypto security as key management, and that’s true for on-chain attacks. Yet the Bobigny case demonstrates that key management is irrelevant once physical coercion is introduced into the threat model.
Seed phrases stored in hardware wallets don’t help when attackers know your address and arrive with weapons. The security failure happened upstream, in the identity layer.
Service economy has already formed
The “uberization” framing from France’s police inspectorate is precise.
Database lookups are sold like commodities, with transparent pricing. The Snapchat price list of €30 for vehicle registration and €150 for wanted-persons checks shows the market is productized.
Sellers are employees with legitimate access who recognize the arbitrage: lookups cost them nothing, buyers pay hundreds, and the risk of detection is low.
What’s missing from countermeasures is an economic model that matches the attacker’s unit economics. France can prosecute individual cases, but the underlying incentive structure of cheap access to valuable identity data remains intact.
The RCS address suppression helps at margins. But it doesn’t address the thousands of government employees who have legitimate access to tax, law enforcement, and judicial databases that contain everything an attacker needs.
Crypto’s promise is disintermediation. No banks, no gatekeepers, no trusted third parties. That model works for censorship resistance and seizure protection.
It fails when the threat is physical coercion enabled by government identity systems.
The Bobigny case makes visible a market structure that usually operates invisibly. Targets don’t know they’ve been looked up until attackers arrive.
