Autor Cointelegraph by Christina Comben

Cybersecurity professionals are having a brutal month. What’s being dubbed Black October isn’t even over, and it’s already brought about several dozen major cyberattacks and AI-identified vulnerabilities across the internet.When critical vulnerabilities in PHP, the programming language used by around 70% of websites, were uncovered with the help of AI tools and disclosed by the PHP Foundation on Oct. 21, the race to patch servers around the world began.Cloud services provider Cloudflare reported millions of attempts to exploit the vulnerability after its disclosure, following thousands of attempts in the preceding hours. Some countries, including France and Finland, temporarily pulled access to certain websites while the US National Security Agency (NSA) warned organizations to patch the flaws immediately or take affected systems offline.“We are at Security Armageddon now,” said NEAR founder Illia Polosukhin. Anthropic’s chief security adviser Jason Clinton warned that, “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better.”Citizens of the United Kingdom are even being urged to “be ready” for an emergency, such as severe weather or cyberattacks, that could cut off access to critical infrastructure such as water, electricity or the internet. US military installation have been told to prep for 90 days of independent operation under the FORTRESS initiative.Houston, do we have a problem? Beyond rushing out to stockpile canned food and walkie-talkies, is there anything else ordinary people can do to mitigate their exposure? So how bad is Black October, really? “It’s really bad. It looks like the rest of the internet is waking up to the reality we had three months ago,” Rob Hamilton, a Bitcoin security researcher involved in the Bitcoin Red Team, tells Magazine.UK government is urging citizens to be ready for an emergency. Source: gov.ukIn the past week or so, cloud platform Railway disclosed that an attacker has accessed and decrypted customer credentials and API keys, apparently targeting AI providers.Related: France is world’s most dangerous place for Bitcoiners: 90 attacks in 7 monthsMedical testing giant Quest Diagnostics confirmed a breach of private patient health data, while Indian security firm eMudhra was found to have eight digital certificate authorities with weak keys that could potentially have let attackers impersonate trusted websites. And code hosting platform GitHub experienced a major service disruption that highlighted how heavily the software world relies on shared infrastructure.GitHub’s senior director of security, Austin Devers, says incidents like this are a “clear reminder that reliability requires constant work,” because modern development is “so connected.”Railway security incident. Source: RailwayJonathan Riss, an OSINT and blockchain intelligence analyst at blockchain security firm CertiK, tells Magazine: “What concerns us most is how a single weakness in shared infrastructure can expose many organizations simultaneously.” Unfortunately, he adds that AI’s ability to find vulnerabilities is not matched by its ability to fix them:“Finding vulnerabilities faster does not automatically give us the capacity to resolve them faster.” Why things are likely to get worseOne reason the problem is getting worse is because AI has changed the economics of cybersecurity. What once required nation-state resources and sophisticated hackers to pull off can now be achieved by a teenager in a basement somewhere.AI entrepreneur and investor Matt Shumer said that AI enables non technical users to find weak spots and exploit them, leaving defenders are “racing to keep up.”“Every weak spot still has to be fixed, tested and installed on millions of systems run by people who are already stretched thin.”Devers says AI-assisted security tools are “dramatically” lowering the barrier to “uncovering complex, deep-seated flaws in widely used codebases.” Related: Keystone says website breach exposed hardware wallet buyers’ addressesWhat can ordinary people actually do?There are some practical steps ordinary folk can use to stay safer online during this volatile period.The internet is under attack. Source: Matt ShumerShumer recommends staying off sites you don’t know, and definitely don’t enter passwords or card numbers into unfamiliar sites “until this blows over” since smaller sites are the “least likely to have patched.”Delete any apps you don’t use and unplug smart gadgets you don’t need. Keep some cash at home and enough groceries for a few days, “if you want to be extra careful.”Devers says the best defense is “locking down personal access points and keeping overall footprints small.” Turn on Multi-Factor Authentication (MFA) across all accounts, ideally using an authenticator app or hardware security key rather than text messages.“This acts as a circuit breaker and stops hackers from logging into your account even if the underlying software is compromised.” Never reuse passwords either, he says. “Create strong, unique passwords for every site, and periodically disconnect old app permissions or third-party connections you no longer use.” Keep your devices and web browsers updated automatically:“While platform teams work to fix cloud-level security issues on the backend, keeping your devices secure ensures hackers can’t use your personal hardware as a back door into your accounts.” To self-custody or not self-custody, that is the questionWhile the alarming rise in security incidents has caused some crypto holders to consider alternatives and some experts to advise against self-custody, others, such as Bitcoin advocate and Casa chief security officer Jameson Lopp, remind users that defeats the whole purpose.“You can only benefit from Bitcoin’s unique properties when you hold your own keys. […] Giving up your keys doesn’t make the risk go away, he says. It moves the risk somewhere you can’t see or control.”Riss recommends separating small amounts you intend to use into a hot wallet, from longer-term holdings in a hardware wallet, and to “actually read what you’re signing rather than approving blind.”While these precautions can reduce your vulnerability to attack, everyday users can only lock down local issues, and have little ability to affect wider problems.You can “reduce blast radius,” he says, “not prevent infrastructure compromise.” So while users can improve their cyber hygiene, ultimately, “the structural burden sits with platforms and providers.”Magazine: Scammer loses $4.8M stored on tampered Ledgers: Asia Express

Crypto investors who failed to report trades in previous years may soon breathe a sigh of relief thanks to legislation currently advancing in the US Congress.Section 502 of the Digital Asset Tax Certainty Act, H.R. 10357, would require the Treasury secretary to establish a Digital Asset Voluntary Disclosure Program within 12 months of the bill becoming law. That would allow eligible taxpayers to correct any past digital asset tax violation by filing amended returns and paying the tax owed, along with interest and a program penalty.The House Ways and Means Committee approved the bill by a 38-5 vote on Sept. 16, but it has not become law yet; it still has to pass the House and Senate and be signed by the president. “It’s a big change that would help a lot of ordinary taxpayers, and it has gotten very little attention,” Andrew Gordon, executive director of Digital Asset Tax Action, tells Magazine.A gap in the systemCrypto investors in the US are already grappling with the first filing season under the new 1099-DA broker reporting rules, which give the IRS greater visibility into crypto transactions.Gordon says those rules should make reporting easier going forward, but they fail to address the years before coming into effect.The House Ways and Means Committee approved the bill by a 38-5 vote. Source: Ways & Means“A large share of investors didn’t report correctly over the years,” he says, and existing procedures don’t offer taxpayers who made “honest mistakes” a predictable way to resolve their liabilities. Related: Greece plans 10% capital gains tax on cryptocurrencies“Today, a crypto investor who learns they didn’t properly report their crypto or has not reported at all has no good way to fix it,” he says; investors can discover years later that they misunderstood the tax treatment of crypto-to-crypto trades or reporting activity across multiple platforms. What taxpayers could getThe IRS’s existing Voluntary Disclosure Practice is aimed at taxpayers who willfully violated tax rules and face potential criminal exposure. For taxpayers with errant reporting skills, they can currently correct their mistakes by filing amended returns, but the penalty treatment is not as predictable as provision 502’s proposed crypto-specific program. Sharon Yip, a certified public accountant (CPA) and founder of Crypto Tax Advisors, says reporting errors among ordinary crypto investors are common.In her firm’s experience, some clients did not report crypto because they believed no tax was due until they cashed out, while others relied on incomplete exchange records or incorrectly classified transactions.“There is no standardized process that gives non-willful crypto investors predictable penalty treatment or a clear resolution,” Yip tells Magazine.She says a crypto-specific program could “fill this gap” by providing a “defined correction period, reduced and predictable penalties and greater certainty for taxpayers who come forward voluntarily.” What the bill would offerUnder Section 502, taxpayers would generally have to file amended returns within 24 months of the program being established, and the bill sets out two penalty tracks. There are lower rates for taxpayers who certify under penalty of perjury that their violations were neither fraudulent nor willful. They would face a 0% penalty on the first $25,000 of tax deficiency per year and 5% on amounts above that, if they file within the first 12 months of the program. For those who don’t certify, rates of 25% on the first $25,000 and 40% above it apply, with the rates increasing if taxpayers miss the initial window. 49% of crypto users understood selling crypto can be a taxable event. Source: CointrackerThere is also relief from specified civil penalties, and taxpayers who don’t certify are protected from criminal referrals based on information properly disclosed for the tax offenses covered by the provision. Yip says taxpayers should check their transaction histories across exchanges and wallets to identify which years need correcting before assessing whether their mistakes were genuinely non-willful. Because falsely certifying carries a penalty of perjury, she advises seeking professional guidance where taxpayers are unsure.Section 502 could come as a welcome relief for many US crypto users; a 2026 report by CoinTracker and Coinbase found that only 49% correctly understood that selling crypto can be a taxable event.Magazine: Crypto lending rises again… but have they solved the risks?Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.

If rising geopolitical tensions weren’t enough cause for concern, now it’s crypto’s turn to go nuclear. The industry is busy debating a cryptography doomsday scenario in which attackers derive private keys from public keys using a formerly far-fetched, but now potentially credible, AI scenario that places everyone’s crypto at risk. Ethereum researcher Justin Drake called for “bunker mode” planning last Wednesday, citing “humbling” advances in artificial intelligence that could accelerate the discovery of mathematical attacks and ultimately “break” cryptography:“IMO it is now reasonable to brace for the possibility that ECDSA [Elliptic Curve Digital Signature Algorithm] breaks before Qday, in the worst case in months not years.”Drake thinks the industry should begin planning a controlled migration of assets to fresh addresses whose public keys have not been exposed, reducing the information a potential attacker could exploit. But what is he basing this warning on, and is there genuine cause for alarm? Is the crypto panic justified? Drake’s concern is not just whether AI will speed up the arrival of quantum computers able to break cryptography, but that AI systems might also help discover mathematical attacks using classical computing that human cryptographers have missed. He argues that elliptic curves — the cryptography that underpins most blockchains — may be more vulnerable to such breakthroughs than hash functions because of their greater mathematical structure, which raises the possibility of a classical algorithm breaking elliptic curve cryptography. Justin Drake wants the industry to plan for bunker mode. Source: Justin DrakeMatthew Green, a cryptography professor at Johns Hopkins University, weighed in on Drake’s assessment, adding fuel to the flames of panic already ripping through the crypto industry.“I think we might lose public key cryptography,” he said.Related: Too big to pause: Could an AI slowdown crash the economy?Not everyone shares their alarm. Coinbase’s head of cryptography, Yehuda Lindell, said that, to his knowledge, there is “no evidence whatsoever” that the decades-old mathematical assumptions underpinning elliptic curve cryptography have been weakened.Lucien Bourdon, Bitcoin analyst at hardware wallet Trezor, tells Magazine:“There are no credible published advances against the math behind ECDSA, with AI or anything else.”He says that none of OpenAI’s recent releases of AI-written math papers contain an attack on ECDSA — although Drake believes that’s cause for suspicion rather than comfort. Drake’s other argument is that elliptic curves have more mathematical structure than hash functions, which could make them easier to break. “He doesn’t say how,” Bourdon says. “He also calls his timeline a worst-case scenario and tells people not to rush.”Zach Herbert, chief executive and cofounder of hardware wallet FoundationHQ, tells Magazine that moving funds to fresh addresses may not be enough if an extended public key (xpub) has already been shared with a wallet app or third party. In that case, “they already have the information needed to derive the public keys you’re trying to hide,” he says.And as Taylor Monahan, founder and chief executive of Ethereum wallet MetaMask, pointed out, if cryptography breaks, the price of your bags won’t be your only concern:“If elliptic curves are broken so that any exposed public key leads to compromise and it’s by a financially-motivated hacker whose top priority is to steal crypto, the entire fu**ing world is going to zero. Having your magic internet coins in bunker mode is not going to help you.”Why moving coins may not be enoughHerbert says xpubs let wallets generate multiple public keys for the same account, including those for addresses that have never been used. If a wallet app or third party already has that information, moving funds to a fresh address within the same account may not hide the new address’s public key from them. If ECDSA became practically breakable, “an attacker could recover the corresponding private keys without ever touching your hardware wallet.” Related: Dragonfly partner rejects ‘bunker mode’ doomerism, calls for proactive blockchain measures“No, it’s obviously not sufficient protection,” Eli Ben-Sasson, co-founder and chief executive of Ethereum scaling protocol StarkWare, tells Magazine.“Other than just moving your coins, if you want to use them ever again, you would need to download new kinds of wallets.” He says a break would affect more than wallet signatures, too. Ethereum’s infrastructure-level signatures and consensus mechanisms would also need attention, as would the Kate-Zaverucha-Goldberg (KZG) polynomial commitment scheme used for data in blobs. “Finally, gas prices would likely also increase dramatically, because a lot of the functionality would break,” he adds.On Bitcoin, some address types conceal the full public key behind a cryptographic hash until the coins are spent. If the relevant hash functions remain secure, this could provide an additional layer of protection against an attacker trying to derive a private key from a public key. Taproot addresses, by contrast, expose a public key directly onchain.Creating a P2PKH public key hash to receive payment. Source: Bitcoin.orgBourdon says common SegWit addresses, which begin with bc1q, keep public keys hidden until spending, and wallets like Trezor generate fresh receiving addresses to limit address reuse. “There’s nothing to do right now,” he says, adding that a panicked migration will do more harm than good. “People who rush to move funds make mistakes, and scammers use stories like this one to reach them.”It’s also worth noting that any time you spend a Bitcoin, the public key gets exposed in the mempool anyway, providing a window of opportunity for an attack.Not all crypto assets are created equalSome blockchains are already preparing for cryptographic threats, although their proposed solutions vary. On AI-focused NEAR Protocol, users can add a quantum-safe FIPS-204 key to an existing mainnet account in a single transaction, without moving their assets, and wallets like Meteor support quantum-safe signing. This relies on lattice based cryptography, which Ethereum creator Vitalik Buterin worries may also be vulnerable to attack. Ethereum is developing a broader post-quantum roadmap using hash based signatures and ZK proof aggregation, that covers everything from transaction signatures to consensus and data security. It also has an emergency hard fork and recovery proposal mapped out on paper. In a March 2024 post, Vitalik Buterin outlined a potential hard fork that would roll back blocks following the onset of mass theft, disable conventional wallet transactions and let users reclaim funds by using zero knowledge proofs of a seed phrase. Related: Vitalik Buterin backs crypto ‘bunker mode’ amid rapid AI math advancesMax Shannon, senior research associate at Bitwise Europe, says that remains a proposal with “no set timeline.” While no one has shown a working attack as of yet, he says users should switch to quantum-safe signatures “over the long term.” Hardfork in a quantum emergency. Source: Eth ResearchStarknet’s account abstraction architecture allows users to switch signature schemes without migrating funds to a new address. Ben-Sasson says the core technology doesn’t need to be changed, “because account abstraction means you can take any signature scheme.” But he says other components still need attention, including parts of the network’s state tree and its reliance on Ethereum for security. Switching to a new address isn’t going to help users on Solana, as public keys are exposed by default — though they can migrate funds to a post quantum vault like Winter Wallet.Solana Foundation technology vice president Jacob Creech said Solana users would not need to enter “bunker mode” if its signature scheme became breakable. A network upgrade could let users prove ownership of their secret seed using a hash-based proof and migrate their accounts to a safer signature scheme. A working proof of concept exists, he says, though the upgrade itself has not been deployed. So, should crypto holders be panicking? Shannon says Bitwise isn’t worrying about this theoretical risk for now, but it’s “worth being prudent over.” “We can discuss fresh addresses and xpub exposure as a thought experiment,” Herbert says, “but I wouldn’t pretend those steps amount to a practical plan for that scenario.”Because some people have old devices, complicated multisignature arrangements, or Bitcoin they haven’t touched in years, he says a software update “would not automatically protect those coins.”Bourdon reminds crypto holders to scrutinize the source, since Drake’s warning was accompanied with talk of Ethereum’s moves toward the hash-based cryptography he recommends. “So the warning about an unproven threat doubles as a pitch for Ethereum’s roadmap,” he says. While that doesn’t prove Drake wrong, there is still no evidence that ECDSA is about to be broken, and plenty of risks involved with rushing to move funds. But if the cryptography underpinning crypto wallets and blockchains does fail, moving coins may be the easiest part of the industry’s response. Magazine: Crypto lending rises again… but have they solved the risks?Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.

Bitcoin developer Paul Sztorc ruffled a few feathers this month with a brutally blunt assessment of the Lightning Network: Bitcoiners are lying to themselves about how well it works.“Most people don’t realize how bad the Lightning Network is,” Sztorc said in an October 4 post on X, “because there has been a vast, years long conspiracy to ***lie*** about the LN user experience.”He argued that custodial Lightning services account for more than 80% of payments, and described their promotion as a “vast campaign of fraud on par with Elizabeth Holmes’ Theranos,” he said, referring to fake blood-testing device company whose founder was convicted of fraud.Lightning payments are private by design, making it impossible to establish the custodial share from public network data alone. Sztorc did not respond to Magazine’s requests for comment. But his scathing criticism resurfaces a topic Bitcoin developers have wrestled with for years: Has Lightning made Bitcoin easier to use, or has the community become so invested in Layer 2 protocol that it overlooks its shortcomings?Lightning has a usability problemLightning was designed to enable faster, cheaper Bitcoin transactions without every payment having to be individually recorded on the blockchain, but its underlying mechanics have often created friction for users and businesses alike.Sztorc says people don’t realize how bad the Lightning Network is. Source: Paul Sztorc In a one-click world where users of TradFi rails can tap a card or click a mouse to complete a transaction, Lightning’s clunky payment channels rely on liquidity being available in the right places at the right times. Routing payments through the network can fail, especially larger payments requiring several hops through different nodes.Related: Big Questions: Does Satoshi actually own 1.1 million Bitcoin?Even Lightning’s head of liquidity, Alex Bosworth, said this month, “the painful truth is that in a setup with privacy and p2p etc it’s extremely slow compared to tap to pay.”Added to that, running a node and managing channels is simply way too technical for the average user, who just wants to pay for stuff and get on with their day. That’s the reason for high estimates of custodial use — it’s easier and works better at the expense of using a trusted intermediary. Everyday payments have a 99.7% success rateJesse Shrader, co-founder and chief executive of Lightning infrastructure provider Amboss, acknowledges that liquidity requirements are “challenging” to understand at first, but he says they are “trivial to solve” with current tools or automation services. He tells Magazine, “For everyday payments of around $100, most users can achieve 99% reliability in the core network,” adding that Amboss’ simulations put the success rate for $100 payments at 99.66%.Lightning exceeded $1 billion in transaction volume in November 2025. Source: RiverWhile that’s an encouraging benchmark, it’s not a verified, network-wide measure of everyone’s experience in practice. As they say in the fine print of advertisements: Your results may vary. In an April 2026 Reddit discussion, one user said he was “genuinely impressed” by where the network had gotten technically, but still questioned how useful it was for everyday spending. “There is still a gap in practice,” he said:“Every coffee shop, grocery store and gas station I walk into runs on Visa or Mastercard terminals. NFC tap to pay is the standard. Nobody is running a Lightning node at the point of sale and nobody is going to.”Have developers solved the problem?Danny Stagg, marketing lead at Bitcoin payments infrastructure provider Breez, says much of the criticism of Lightning’s user experience is now outdated.“The criticism is not fair in 2026,” he tells Magazine, “but historically it was. For years, both developers and users were asked to understand the complexities of Lightning, like channels and inbound liquidity, just to get paid.”He says the network has greatly improved over the past two years, with newer infrastructure abstracting much of that complexity away. “Non-custodial UX is now comparable with custodial,” he says.Users no longer need to manage channels or run their own nodes for a wallet or application to offer Lightning payments, as developers and service providers can handle much of the work underneath the hood.Related: Lightning Network hits record capacity on crypto exchange adoptionBreez chief executive Roy Sheinfeld says that AI coding tools are making it easier for developers to build Bitcoin-enabled applications, and inquiries from prospective partners have rapidly increased.“That’s why we’re seeing more partners add Bitcoin every quarter,” Stagg says.But growing developer interest does not necessarily mean more people are using Lightning for everyday payments. The numbers show activity, not necessarily successAccording to its 2026 Bitcoin adoption report, financial services company River estimated that Lightning processed $1.17 billion in transaction volume across 5.22 million transactions in November 2025 alone.While that seems like an impressive number, it remains below Lightning’s August 2023 peak of 6.6 million transactions, suggesting transaction counts have not kept pace with the value moving through the network. Crypto payment processor CoinGate reported 782,403 paid crypto orders across its own customer base in the first half of 2026, up 21.4% year over year, with Lightning accounting for 9.6% of Bitcoin payments processed through its service.Lightning accounted for 9.6% of Bitcoin payments. Source: CoinGateWhat would count as success?Shrader says that since network-level payment statistics are “impossible to produce unless you are party to the transactions themselves,” he isn’t buying Sztorc’s claim that more than 80% of Lightning payments are custodial.“I distrust anyone who claims they can prove an 80% custodial share either way from public data alone.” Stagg says the claim “describes yesterday’s Lightning,” when custodial services offered an easier experience and non-custodial services hadn’t “caught up” yet. (Back in 2023, River estimated one self custodial user for every eight custodial users). But without hard data that’s up to date, the custody question can’t be settled. And the same caution should apply to claims about Lightning adoption measured in metrics like payment volume, network capacity or developer interest; each measures something different, and none alone can establish how easy Lightning is to use. Businesses are processing payments and developers are finding ways to abstract technical complexity, but technical progress is not the same as mainstream usability. The real criticism may not be that Lightning has failed, but whether its supporters conflate evidence of what the network can do with what people are actually doing on the network.Related: Bitcoin treasury firms can outperform BTC… but is the risk worth taking?Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.

French authorities have recorded 90 cases involving kidnapping, abduction, extortion, threats, and violent theft related to cryptocurrencies in just over seven months.The figures, provided to Cointelegraph by the French Interior Ministry, are from Jan. 1 to mid-August 2026. Authorities also recorded 223 arrests, and 126 people were imprisoned from January to July. The figures equate to a new case every two and a half days, although there is no official year-on-year comparison to understand if the problem has become suddenly worse: “We do not have the statistics on these items for 2025, as the recording of events began on Jan. 1, 2026,” the ministry says. What makes the new numbers even more striking is they are much higher than other public trackers of meatspace attacks. Chainalysis counted 30 publicly known violent crypto incidents in France through mid-2026, but noted that the scale was “almost certainly larger.” Security firm Gart.io has tracked 73 attacks in France in the year to date, which puts France in the number one spot ahead of the USA on 66 real world attacks, and the UK on 27. The rise in physical attacks — known as “wrench attacks” — on crypto holders in France points to something bigger than a rash of isolated incidents. Leaked personal data may be the culprit. So, why France?Wrench attacks are far from a new phenomenon. Bitcoin security advocate Jameson Lopp’s long-running directory of known physical attacks has documented 365 cases across 60 countries between 2014 and 2026, with France topping the leaderboard.Related: Home invasions became most common crypto wrench attack in H1 2026: CertiKWhat seems to be new, however, is the speed at which violent crypto crimes are spreading throughout the country. Attacks have gone beyond Paris to places including Strasbourg, Marseille, Grenoble, Toulouse and Nantes, according to Chainalysis. Violent attacks above the historical baseline. Source: Chainalysis.Criminals aren’t targeting crypto rich tourists, and of the victims with known residency, 93% were French. Chainalysis head researcher Eric Jardine tells Cointelegraph the surge is “very likely” due to a “significant data breach.”“These sort of breaches expose more than financial information; they reveal who holds crypto, where they live, and how to find them.”That makes physical attacks against crypto holders particularly insidious because they can begin long before a thug shows up with a wrench demanding your seed phrase or a crypto transfer. The assailants first need to know who has something worth stealing, where they live and how to reach them.Jardine says the French tax authority compromise in 2024, where a tax official in the Paris area “leaked PII, financial and crypto holding information on French taxpayers,” may have been the accelerant. Chainalysis records show attacks surged from late November of the same year.Chainalysis also points to a further incident in January 2026, with crypto tax reporting firm Waltio disclosing a breach affecting some 50,000 users, creating yet more useful data for attackers to mark their targets.Francis Pouliot, founder of Canadian Bitcoin exchange Bull Bitcoin, has repeatedly challenged Europe’s DAC8 crypto reporting rules in France, which expand tax reporting and information-sharing requirements for crypto users across the European Union. “DAC8 has transformed the concept of Know Your Customer into Kill Your Customer,” he said, along with describing France as the “crypto kidnapping capital of the world.” The world of physical attacks. Source: Gart.ioWhen the target isn’t the BitcoinerAccording to Chainalysis, one of the most revealing changes may be who is being attacked. Globally, relatives and acquaintances accounted for around 25% to 30% of violent crypto incidents by early 2026, and in France, the proportion was more than 40%.In May 2026, six men allegedly tried to abduct the wife of The Sandbox co-founder Sébastien Borget from the couple’s home in Villenoy, France, with one attacker posing as a delivery driver to get her to open the gate.In August, a couple in rural France reportedly endured three separate attempts to break into their home after buying a property previously occupied by crypto millionaires, after the previous owners’ tax information and address were leaked onto the dark web.A similar tactic was used in 2025, when the father of a crypto entrepreneur was abducted in Paris and held for two days, with the kidnappers reportedly cutting off part of his finger and sending it to his son while demanding $5.6 million in cryptocurrency. Jardine says the targeting of relatives and associates “suggests criminals are doing reconnaissance before they act,” whether by “monitoring social media, analyzing blockchain data, using leaked information, or receiving tips from insiders.” That turns the usual idea of a crypto target on its head, since the person with the wallet may not be the person standing in front of the attacker. French authorities are responding by treating the attacks as organized crime, coordinating investigations through JUNALCO, the country’s specialized organized crime jurisdiction.The $5 wrench conundrumMost crypto holders have learned how to protect their seed phrases, set up hardware wallets, test their environments and avoid clicking on phishing links.While those things are still important, none of them will help if a bad actor already knows who they are, where they live and that they have something worth stealing in the first place. Cryptography can protect a wallet, but it can’t stop an attacker with a $5 wrench.Related: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix itCointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.