A confirmed intrusion at the French tax authority, a wave of crypto kidnappings, a wallet registry abandoned in Parliament: 2026 is redrawing the transparency debate.
On August 13, 2026, the French Ministry of the Economy and Finance confirmed that an unauthorised access to the information system of the French tax authority (Direction générale des Finances publiques, DGFiP), which occurred in late June following an identity compromise, allowed the consultation and extraction of data concerning individuals and businesses. The day before, a threat actor had claimed on a specialised forum to hold the tax records of more than 678,000 taxpayers, a figure the administration has not confirmed. Three months earlier, the French Parliament had abandoned, in its final legislative committee, a plan to create an annual reporting obligation for self-custody crypto wallets.
The collision of these two sequences is anything but anecdotal. It raises a question French tax policy can no longer avoid: to what extent can the growing centralisation of wealth data in the hands of the tax administration, fed by domestic reporting obligations and by international automatic exchange, be extended to crypto-assets when the security of that data is demonstrably not assured, and when its compromise now exposes taxpayers to a risk that is no longer merely fiscal, but physical?
To answer it, one must first measure what the French administration already knows about the crypto holdings of its residents (I), then confront that accumulation of data with the facts of 2026, intrusions into the tax authority's systems and a wave of kidnappings targeting crypto holders (II), before analysing the legislative episode of the self-custody wallet registry and setting out our position on the conditions to which any future extension should be subject (III).
I. What the French Tax Authority Already Knows About Crypto Holdings
A. Reporting obligations in force: foreign-held wallets
A long-standing obligation with a recently rewritten scope. Under Article 1649 bis C of the French Tax Code (Code général des impôts, CGI), in its version in force since July 1, 2026, individuals and entities domiciled or established in France must report, together with their income or corporate tax return, the references of crypto-asset wallets falling within the EU Markets in Crypto-Assets Regulation, known as MiCA (Regulation (EU) 2023/1114 of May 31, 2023), that are opened, held, used or closed with undertakings, legal persons, institutions or organisations established abroad, as well as unique, non-fungible crypto-assets held or used abroad (CGI, art. 1649 bis C). The decisive criterion remains the existence of a foreign intermediary: an exchange, a custodian, a crypto-asset service provider established outside France. For internationally mobile clients, this typically captures accounts held with any platform incorporated abroad, however incidental their use.
One point deserves to be stated plainly, because confusion is widespread, including in the press: the self-custody wallet, where the user directly controls the private keys without any service provider, is not within the scope of this obligation. Neither a hardware wallet kept at home nor a decentralised software wallet is, as the law currently stands, reportable as such in France. That perimeter very nearly changed in the spring of 2026; we return to it in Part III. Conversely, any account or wallet opened with a foreign platform, even dormant, even closed during the year, must be reported, and practice shows this duty is massively overlooked by taxpayers, French residents and returning expatriates alike.
Penalties that become punishing through accumulation. Failure to report is sanctioned by a fine of 750 euros per unreported wallet or unique non-fungible crypto-asset, and 125 euros per omission or inaccuracy, capped at 10,000 euros per return; those amounts rise to 1,500 euros and 250 euros respectively where the market value of the assets concerned exceeded 50,000 euros at any point during the year (CGI, art. 1736, X). A taxpayer holding accounts on three foreign platforms for four years is therefore exposed, through reporting fines alone and before any discussion of tax on gains, to several thousand euros in penalties. Voluntary disclosure, before any enquiry from the administration, remains in almost every case the rational strategy.
B. DAC8 and CARF: automatic exchange changes the scale
What the taxpayer does not report, the service provider will. Council Directive (EU) 2023/2226 of October 17, 2023, the eighth revision of the Directive on Administrative Cooperation and known as DAC8, extends automatic exchange of information to crypto-assets. Transposed in France by the Finance Act for 2025, which inserted Articles 1649 AC bis to 1649 AC sexies into the Tax Code, it requires crypto-asset service providers, including those established outside the European Union where they serve EU residents, to collect, verify and report the full identity of their users and the details of their transactions. The obligations apply to transactions carried out from January 1, 2026, with first transmissions to tax administrations in early 2027, under implementing rules specified by decree in late 2025.
The mechanism sits within the international framework designed by the OECD, the Crypto-Asset Reporting Framework (CARF), to which several dozen jurisdictions have committed. A provider's failure to meet its reporting duties is itself sanctioned in France by a fine of 15 euros per unreported or inaccurate transaction, capped at two million euros per provider per year (CGI, art. 1736, 6). In other words, the era of invisibility for platform-held assets is over: the French administration will automatically and recurrently receive the identity, tax residence and portfolio valuations of its residents held with regulated providers, in Europe and beyond. For cross-border families, the practical consequence is that a wallet opened years ago with a foreign exchange will surface, whether or not it was ever reported.
The consequence deserves to be stated without circumlocution. Between taxpayers' own filings (income, foreign accounts and wallets, real estate, the French real estate wealth tax) and inbound automatic exchange flows (the Common Reporting Standard for financial accounts, DAC8 and CARF for crypto-assets), the French tax administration now concentrates one of the most complete wealth maps in the world. That concentration is a defensible policy choice in the fight against tax fraud. But it carries a counterpart which public debate has long ignored: every data point collected is also a data point to protect, and the value of the database to an attacker grows at exactly the same rate as its usefulness to tax enforcement.
II. Vulnerable Databases, Exposed Taxpayers
A. The 2026 intrusions into the tax authority's systems
Separating the confirmed from the claimed. Rigour requires distinguishing two levels of information in the affair made public on August 13, 2026. Confirmed by the Ministry's statement: an unauthorised access to the DGFiP's information system, occurring in late June 2026 after an identity compromise, which allowed the consultation and extraction of data concerning individuals and businesses; the administration specifies that personal accounts on the impots.gouv.fr portal were not compromised, that the accesses at issue were cut off, and that affected users will receive individual notification. By contrast, the following remains solely the attacker's claim, unconfirmed to date: the figure of 678,438 persons concerned, the offering of the file for sale, and an alleged second leak covering nearly two million property owners. According to press reports, the extracted data may include items as sensitive as household composition, the taxpayer's withholding rate and the reference taxable income.
This episode is not isolated. Specialised press reports that an earlier incident, confirmed by the administration, had already occurred between late January and mid-February 2026: compromised credentials of a public agent had been used to access a sensitive national file. Two confirmed compromises within a single calendar year, on systems concentrating the wealth data of tens of millions of households, can no longer be treated as peripheral accidents. They establish a structural fact: the implicit promise underlying consent to reporting obligations, namely that the State protects what it collects, is not currently being kept at the standard which the sensitivity of the data demands. Foreign observers should note that this is not a uniquely French weakness; it is, however, in France that its consequences have become most tangible.
B. From the file to the front door: the risk is no longer merely fiscal
A criminal economy that targets holders, not systems. Since 2024, France has experienced a wave of kidnappings, unlawful confinements and extortions targeting crypto-asset holders that is without equivalent worldwide, known in the industry as wrench attacks. On June 30, 2026, the French Interior Minister publicly put the number of such incidents recorded since the start of the year at 77, against 45 for the whole of 2025 and around thirty in 2024. The January 2025 kidnapping of the co-founder of a French hardware wallet company, who was mutilated to support a ransom demand, marked the turning point in public awareness; since then, holders' families, spouses and children included, have been directly targeted, with ransoms demanded in cryptocurrency and frequently ranging from several hundred thousand to more than one million euros.
The modus operandi described by investigators is constant, and it bears directly on our subject: data theft or acquisition, precise identification of targets flagged as wealthy in digital assets, then physical action. The raw material of this criminal economy is not a technical flaw in any blockchain, which is almost never attacked; it is nominative information about who holds what. Leaked customer databases of platforms and wallet manufacturers, shipping data, social media exposure: every file linking an identity, an address and a crypto holding is, for these networks, a targeting instrument. A national tax file listing holders, their addresses and the valuation of their portfolios would be, within that economy, the single most valuable asset in existence.
This is where the two 2026 fact patterns converge, and where legal analysis must absorb a new parameter. Where the compromise of a tax database exposes the taxpayer to reassessment, the harm is financial and reparable. Where it exposes the taxpayer to kidnapping, the harm changes in nature. The security standard demandable of a State holding wealth data must be assessed against that risk, and no longer solely under data protection law. Taxpayers are entitled to raise that requirement against any extension of the collected perimeter, in France and in every jurisdiction implementing CARF.
III. The Self-Custody Wallet Registry: A Bad Idea Rightly Abandoned
A. From an official recommendation to abandonment in committee
A lightning legislative round trip. In December 2025, the Conseil des prélèvements obligatoires, an advisory body attached to the French Court of Auditors, recommended in a report on wealth taxation that DAC8 be supplemented by a reporting obligation covering self-custody wallets held by French residents. On December 9, 2025, an amendment to that effect was adopted in the Finance Committee of the National Assembly within the bill on the fight against social and tax fraud. As Article 3 quater of the bill, the mechanism required holders of self-hosted digital asset wallets, managed without recourse to any service provider, to notify the tax administration each year of the market value of their portfolio once it exceeded 5,000 euros. The National Assembly adopted it at first reading in early April 2026. On April 28, 2026, the joint committee of both chambers declined to retain the article, which did not survive into the final text.
The arguments that carried the decision deserve attention, because they align precisely with the analysis set out above. Beyond the objection of principle, that turning self-custody into a zone of permanent suspicion contradicts the very nature of these assets, it was the security argument that weighed most: a file listing crypto-asset holders constitutes a target, not only for cyber attackers, but for criminal networks seeking solvent, locatable and vulnerable profiles. Four months later, the confirmation of a data extraction from within the tax authority itself gives that argument a force its proponents could hardly have anticipated.
B. Our position: no extension of scope without a State duty of result on security
Marginal enforcement value, maximal risk. Our conviction is that the self-custody wallet registry combined every defect. Its enforcement value was marginal: a purely declaratory obligation covering assets whose existence and valuation the administration cannot verify captures only good-faith taxpayers, while DAC8 and CARF already cover the genuinely controllable checkpoints, namely the service providers through which conversions into fiat currency sooner or later flow. Its risk, by contrast, was maximal: the creation of the first State file nominatively listing holders of assets that can be extracted through physical coercion, in the country which, according to police data reported in the press, already concentrates the majority of the world's physical attacks on crypto holders. Parliament was right to step back.
The debate will nonetheless return, and it must be prepared for. The Conseil des prélèvements obligatoires' recommendation remains on the table, the European anti-money-laundering agenda may revive the question at Union level, and the budgetary temptation to close the perceived blind spots of crypto taxation will not disappear. Our position for that coming debate is the following: no extension of the wealth-reporting perimeter should be enacted unless the law simultaneously imposes on the State, as data holder, a genuine duty of result on security, comprising at minimum the minimisation of collected data to what enforcement strictly requires, the segregation and encryption of wealth databases, the logging and detection of abnormal access, prompt individual notification of affected persons in the event of compromise, and a State liability regime commensurate with the harms, including physical harms, that exposure of such data can cause. Transparency is a contract: it can be demanded on one side only if protection is guaranteed on the other.
Criticism excuses nothing. One point must be expressed without the slightest ambiguity, because it separates constructive criticism from complacency: the law as it stands applies in full. Wallets held with foreign service providers must be reported (CGI, art. 1649 bis C), taxable gains must be declared, and automatic exchange will make omissions detectable ever faster. A taxpayer who drew from the fragility of State systems a justification for not reporting would commit a double error, legal and strategic: the fines under Article 1736, X of the Tax Code apply per wallet and per year, and the negotiating position of a taxpayer who has come forward voluntarily bears no comparison with that of one caught by a DAC8 data flow. The case for a more secure State is made through public debate and, where appropriate, litigation; never through non-compliance.
Conclusion
In the space of four months, 2026 has delivered a complete demonstration: a Parliament abandoning the creation of a self-custody wallet registry on target-file grounds, a tax administration confirming the extraction of wealth data from its own information system, and a criminal economy converting files into reconnaissance and reconnaissance into kidnappings. These facts do not condemn tax transparency, which remains a legitimate objective and an international commitment of France; they reveal its condition of validity.
Our conviction is that wealth data must now be handled by the State with the same fully enforceable responsibility it demands of taxpayers in meeting their obligations. As long as the security of tax databases rests on best efforts rather than a duty of result, any extension of the collected perimeter, in particular towards self-custody wallets, should be resisted, and it will be resisted with arguments that the facts of 2026 have made difficult to refute, in France and in every CARF jurisdiction watching the French precedent.
For crypto-asset holders, the recommendation is twofold and immediate. On the reporting front, verify compliance without delay: inventory all wallets and accounts held with foreign providers, file any omitted declarations, and regularise voluntarily where needed, before the first DAC8 flows reach the administration in early 2027. On the security front, reduce your informational exposure: public discretion about holdings, separation of delivery and residence addresses, transfer time-locks. A compliance audit conducted upstream costs a fraction of the fines, surcharges and risks it neutralises.
Frequently asked questions
Do I have to report my self-custody crypto wallet (hardware or software) to the French tax authority?
No, not as such under the law as it stands in August 2026. The reporting obligation of Article 1649 bis C of the French Tax Code covers wallets opened, held, used or closed with organisations established abroad, that is, involving a service provider. The proposed annual reporting of self-custody wallets above 5,000 euros, adopted by the National Assembly in April 2026, was dropped by the joint parliamentary committee on April 28, 2026. Taxable gains realised through a self-custody wallet must however still be declared, and the registry debate may return.
What are the penalties for failing to report a crypto account or wallet held on a foreign platform?
The fine is 750 euros per unreported wallet and 125 euros per omission or inaccuracy, capped at 10,000 euros per return; those amounts rise to 1,500 euros and 250 euros where the value of the wallets concerned exceeded 50,000 euros at any point in the year (CGI, art. 1736, X). The fines apply year by year and come on top of tax reassessments and surcharges on undeclared gains. Voluntary disclosure, before any enquiry from the administration, places the taxpayer in an incomparably stronger position.
Was my French tax data leaked in the DGFiP breach and what should I do?
The administration confirmed on August 13, 2026 an unauthorised access allowing the extraction of data concerning individuals and businesses, and undertook to notify each affected user individually, specifying the data involved. The figure of more than 678,000 taxpayers comes from the attacker's claim and is unconfirmed. If you are notified, immediately heighten vigilance against targeted phishing and identity fraud, and keep the notification: it will document any future claim. Crypto-asset holders should be especially cautious, as wealth data is used to target physical attacks.
What do crypto platforms report to tax authorities since 2026 under DAC8?
Since January 1, 2026, under Council Directive (EU) 2023/2226, known as DAC8 and transposed into Articles 1649 AC bis et seq. of the French Tax Code, crypto-asset service providers collect and report the full identity of their users, their tax residence and the details of their transactions, including where the provider is established outside the European Union but serves EU residents. First transmissions to administrations occur in early 2027 and feed automatic exchange between States under the OECD's CARF framework. Platform-held assets are therefore no longer invisible to the French tax authority.