bitcoinmixKYC Data Leaks Put Crypto Holders at Risk: How to Keep Bitcoin Private
Tax files, exchange records and bank databases keep leaking. Criminals now use them to find crypto holders at home. This report traces the biggest KYC leaks, explains how they turn into attacks, then shows how to make leaked data point nowhere.
On June 30, 2025, French investigators detained a 32-year-old tax official working near Paris. Prosecutors accuse her of using government tax software to look up people's home addresses, then passing the details to criminals. Among the profiles reportedly pulled were people suspected of holding large amounts of cryptocurrency. She denies knowing what the information would be used for. The case is still under investigation.
A year later, France had become the world's hotspot for so-called wrench attacks: kidnappings, home invasions and beatings aimed at forcing crypto holders to hand over their coins. The lesson reaches far beyond one country. When a database that links your name to your Bitcoin leaks, the risk no longer stays online.
A Tax File That Turned Into a Target List
The tax official, identified in French media as Ghalia C., is accused of complicity in violence and criminal conspiracy, according to reporting by Gizmodo. A Paris appeals court refused her release in January 2026. Her case is only one thread in a wider pattern. The violence had already reached the industry's best-known names. In January 2025, Ledger co-founder David Balland was abducted from his home in central France. Police freed him the next day, DL News reported.
In January 2026, French crypto tax platform Waltio disclosed an extortion attempt after attackers took data linked to about 50,000 accounts. The stolen files included 2024 tax reports with email addresses, gains, losses and year-end asset balances, DL News reported. French authorities warned users about possible physical attacks.
Then, in August 2026, the French tax administration confirmed that hackers had used stolen staff credentials to reach records on about 678,000 taxpayers. Reported data included names, addresses and reference income. About 27,000 of those people had declared at least €100,000 a year, Unchained reported.
The numbers that followed are stark:
- 41 kidnappings of crypto holders in France in the first three and a half months of 2026, according to figures cited by the national organized crime prosecutor.
- 30 of 46 violent crypto attacks recorded worldwide in the first half of 2026 took place in France, according to Chainalysis data reported by Decrypt.
- More than $30 million was taken in those attacks in six months.
Chainalysis says the tax-record compromise likely widened the pool of people criminals could target. It also notes that victims are often found through leaks, social media or insider tips. In other words, the attackers did not need to break any blockchain. They only needed a name next to a balance.
It Is Not Just France: Leaks That Exposed Crypto Holders
France is the sharpest example, but the same story repeats across banks, exchanges, wallet makers and service providers. The table below lists some of the best-documented cases.
| Year | Company | What Leaked | How It Happened |
|---|---|---|---|
| 2020 | Ledger | 272,000 home addresses and about 1 million emails | Marketing and e-commerce database exposed, later dumped online |
| 2022 | Revolut | Data on 50,150 customers, including names and addresses | An employee was tricked by social engineering |
| 2023 | Kroll (FTX, BlockFi, Genesis claims) | Names, addresses, emails and claim balances | A staff phone number was hijacked in a SIM swap |
| 2024–2025 | Coinbase | Data on 69,461 people, including ID images | Overseas support agents were bribed |
| 2026 | Waltio | Tax reports for about 50,000 accounts | Extortion attack by a hacking group |
| 2026 | French tax administration | Records on about 678,000 taxpayers | Staff credentials were stolen |
Ledger: The Leak That Started the Doorstep Threats
In 2020, a breach of Ledger's marketing database exposed contact details of hardware wallet buyers. When the full file appeared on a hacking forum, it contained 272,000 home addresses, as Cointelegraph documented. Customers soon received phishing emails. Some also got threatening letters demanding payment in Bitcoin. Buying a device to protect coins had placed buyers on a list of likely holders.
Revolut: One Tricked Employee, 50,000 Customers
In September 2022, an attacker gained access to Revolut's systems by manipulating a staff member. Personal details of 50,150 customers were exposed. Phishing messages imitating the bank quickly followed, Which? reported. No funds were taken. Still, names and postal addresses of customers of a crypto-friendly bank were now in criminal hands.
Coinbase: When Insiders Sell the Data
In May 2025, Coinbase disclosed that criminals had bribed overseas support agents to copy customer records. The stolen data covered 69,461 people and included government ID images, The Register reported. The attackers then demanded $20 million. Coinbase refused to pay and estimated the cost of the incident at up to $400 million. The data was reportedly used to impersonate staff in targeted scams.
Kroll: A Bankruptcy Claim Becomes a Lead
In August 2023, a SIM swap against one Kroll employee exposed data on people claiming funds from collapsed lenders FTX, BlockFi and Genesis. For some claimants, the leak showed names, addresses and account balances, Help Net Security reported. These were people who had already lost money. Now their remaining claims were on display too.
Why a KYC Leak Hurts More Than a Password Leak
Most data breaches are bad. Know-your-customer data, or KYC, is in a category of its own, for three reasons.
It never expires. A leaked password can be changed in a minute. A passport number, a face scan or a home address cannot. Once a KYC record leaks, it stays useful to criminals for years.
It connects identity to money. An exchange record does not just say who you are. It says what you hold, where you withdrew it and when. That combination is exactly what a robber needs to choose a target.
The blockchain remembers everything. If a leaked record contains one of your wallet addresses, anyone can follow that wallet's history forward. Every payment, every transfer and every new address funded from it becomes part of your profile. A single leak can expose years of activity.
Under European financial-crime rules, regulated firms generally keep customer records for at least five years after an account closes. Closing an account therefore does not remove you from the database.
From Spreadsheet to Doorstep: How a Leak Becomes an Attack
Investigators describe a recurring chain of events. First, a leak or an insider produces a list of names, addresses and account data. Next, buyers filter that list for people likely to hold crypto, often by balance or income. Then they confirm the target, sometimes by tracing a known wallet on a public block explorer. Finally, a hired crew shows up at the door.
Chainalysis summed up these crews as "amateur at the point of violence, but professional at both ends." The research, the data purchase and the cashing out of stolen coins are organized. Only the break-in itself is crude.
Bitcoin developer Jameson Lopp keeps a public log of physical attacks on crypto holders going back more than a decade. It shows a steady rise, with 2025 setting a record. The common thread in many entries is simple: the attacker knew who the victim was and roughly what they held.
The Real Fix: Make Leaked Data Point Nowhere
No individual can stop a tax office, a bank or an exchange from being breached. However, anyone can control what that leaked data reveals. The goal is simple: a leaked record should lead to a wallet that is empty, closed or unrelated to your savings.
That means keeping a clear gap between two worlds:
- The identified world: exchange accounts, bank cards and any wallet that ever received a KYC withdrawal. Assume all of it will leak one day.
- The private world: the wallets that actually hold your savings or make your everyday payments. None of them should have an on-chain link to the identified world.
A Bitcoin mixer builds that gap. Coins leave an exchange-linked address for a single-use mixing address. Hours later, on a schedule you set, fresh coins land in a new wallet with no visible connection to the old one. If the exchange database leaks later, the trail ends at the mixer. Your savings wallet never appears in it.
What a Leaked Record Reveals, With and Without a Gap
| In the Leaked File | Wallets Linked Directly | Gap Created by a Mixer |
|---|---|---|
| Name and home address | Visible | Visible |
| Exchange withdrawal address | Visible | Visible |
| Current savings balance | Traceable on-chain | Not linked |
| Later payments and purchases | Traceable on-chain | Not linked |
| New wallets you create | Traceable on-chain | Not linked |
The first two rows cannot be fixed after a leak. The last three can. They are the ones that tell a criminal whether you are worth targeting.
What to Do If Your Data Was in a Leak
If a company tells you that your data was exposed, act calmly but quickly.
- Treat every contact as suspicious. Leaks are followed by phishing. No real company will ask for a seed phrase, a private key or a remote session.
- Move funds away from known addresses. Any wallet tied to the leaked account should be considered public. Send its balance through a mixer into a brand-new wallet.
- Stop reusing the exposed wallets. Do not receive new payments on them. Do not fund new wallets from them directly.
- Shrink your public footprint. Remove posts that hint at holdings. Avoid crypto merchandise or wallet boxes that reveal what you own.
- Use a different delivery address for hardware wallets or anything crypto-related, such as a mailbox service or a workplace address.
- Split your holdings. Keeping a modest balance in an easy-to-reach wallet limits what anyone can demand under pressure.
For the wallet side in more depth, read the Bitcoin privacy guide. Ethereum users face extra linking risks, explained in the Ethereum privacy guide.
Frequently Asked Questions
What Is a KYC Data Leak?
It is the exposure of identity records that a financial company collected to verify its customers. These often include names, addresses, ID documents, selfies and account balances. Leaks happen through hacking, tricked employees, bribed insiders or careless third-party vendors.
Which Crypto Companies Have Leaked Customer Data?
Well-documented cases include Ledger in 2020, Kroll's bankruptcy claims data in 2023, Coinbase in 2025 and Waltio in 2026. Banks such as Revolut have also suffered breaches. Government databases, like the French tax administration, have been compromised too.
What Is a Wrench Attack?
A wrench attack is a physical attack meant to force someone to hand over crypto. The name comes from the idea that a simple tool can defeat the strongest encryption. Kidnappings and home invasions are the most common forms.
Can I Ask an Exchange to Delete My KYC Data?
Usually not right away. Regulated firms must keep customer records for several years, often at least five after an account closes. The practical protection is to make sure that data no longer points to your current wallets.
How Does a Mixer Help After a Leak?
A mixer breaks the on-chain link between an exchange-linked address and a new wallet. The leaked record may still show your name and your old withdrawal address. It no longer leads to where your coins are now.
Is a Hardware Wallet Enough to Stay Safe?
It keeps your private keys away from malware. Your balance and your identity stay exactly as visible as before. As the Ledger case showed, even buying one can put your address on a list.
Sources
- French tax agent allegedly sold personal data of crypto users to criminals, Gizmodo
- French tax agency breach exposes about 678,000 taxpayers, Unchained
- Hackers extort French crypto firm Waltio, DL News
- Crypto wrench attacks: $30M stolen in 2026, Decrypt
- Ledger data leak exposed 270K crypto wallet buyers, Cointelegraph
- Revolut data hack: what you need to know, Which?
- Coinbase confirms insiders handed over data of 70K users, The Register
- Kroll SIM-swap attack: FTX, BlockFi and Genesis clients' info exposed, Help Net Security
- Ledger co-founder David Balland and wife kidnapped in France, DL News
- Physical Bitcoin attacks log, Jameson Lopp
- Know your customer, Wikipedia