France logged fake crypto support calls five months before the tax breach began
Meria's Owen Simonin ties a wave of calls impersonating Binance and his own support desk to France's pile-up of data leaks. The state cyber agency was already recording the same script in January, before the DGFiP intrusion.
The Investor · Invest desk
What happened
- Owen Simonin, founder of the French platform Meria, said in a September 20 post on X that a wave of calls from people posing as exchange support staff follows France's run of data breaches.
- The callers have impersonated Binance support and Meria's own staff, telling holders their account is compromised and that funds must move at once to a wallet the caller supplies.
- France's tax authority said in mid-August that an intruder had used a stolen identity to pull personal and tax records, in a breach that began in late June and was closed by the end of that month.
Why it matters
- Who's exposed exposure A holder whose number sat in the tax file can be called by someone who already knows their address, birth details and tax ID, so the identity questions a support desk would ask are answerable by the caller.
- What it costs cost Simonin expects generative tools to cut the cost of each attempt, and the payout per success is a whole wallet balance, which stands where a card payment would be reversed.
- What it limits constraint Recovery after transfer is rarely possible, so the loss lands on the holder, and the call itself is the only place to stop it.
Next story · Invest · 2h ago
Tokenized stock trading grew 55-fold in 2026 against a sixfold rise in value, DWF Labs findsConfirmed3 publishers
A cold-calling operation spends most of its money dialling people who turn out not to own crypto. A leaked tax file removes that waste. The fields the DGFiP said may have been exposed include names, birth information, addresses, phone numbers, email addresses and tax ID numbers [21]. Cross-reference those against other leaks and you have the holders and the platforms they use, Simonin said [4]. The script that follows is short. The caller says the account is compromised, and the fix is to move the funds straight to a secure wallet that belongs to the caller [1].
The dates point to more than one cause. Cybermalveillance.gouv.fr flagged the same pattern on January 22, when its 17Cyber help line was inundated with reports from holders contacted by fake crypto operators and fake bank anti-fraud desks [9]. The DGFiP intrusion began in late June and was closed by the end of that month [8], about five months later [17]. Whatever fed the January calls was already in circulation. Crowdfund Insider reported that separate accounts have described large commercial lists of French crypto users circulating in underground markets [25].
"We're going through a phase where data leaks are piling up in private companies as well as in the public sector," Simonin wrote in French, according to X's translation [3]. On the size of the exposed pool the two publishers differ. Cryptopolitan put the estimates at 678,000 taxpayers up to millions of people [21], and Crowdfund Insider said officials confirmed records belonging to hundreds of thousands of taxpayers [22]. Read "millions" as two million and the top end is about three times the 678,000 floor [23].
The violent route costs more than the phone route. Pavel Durov said in April that France had seen 41 kidnappings of crypto holders in the first three and a half months of 2026 [12]. Interior Minister Laurent Nuñez counted 77 kidnappings, unlawful detentions, extortions or attempts linked to crypto by the end of June, against 45 in all of 2025 [13]. That is roughly 36 more incidents in about two and a half months, or some 14 a month [19]. About 200 people have been arrested after attacks or in preventive operations [14], about 2.6 for every recorded incident [20]. The phone scams run alongside those attacks [15].
In my view the data is the scarce input and the tax records are the cheapest version of it so far. The counter-thesis is that the lists were always commercial and sourced from the platforms themselves, in which case the public-sector breaches change little and the January bulletin supports that reading [9]. The one named thread that could settle provenance is the preliminary investigation into the crypto firm Waltio, run by the Paris prosecutor's cybercrime section and the national gendarmerie cyber unit [11]. Neither publisher reported how much money the callers have taken [18].
Simonin has warned that generative tools will make these campaigns cheaper and more scalable, letting attackers automate the outreach and refine the scripts at speed [24]. Once coins leave a victim's wallet, recovery is rarely possible, Crowdfund Insider reported [16].
What to watch
- Whether the DGFiP revises its exposure count above the 678,000 taxpayer floor, which would reprice the size of the callable list.
- Whether the preliminary investigation into Waltio by the Paris prosecutor's cybercrime section produces findings on where the crypto-holder lists originated.
- Whether any French authority puts a euro loss figure on the fake-support calls, the way it has counted violent incidents.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence47
- Adoption44
- Hype gap+28
- Incentives68
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Fraudsters posing as exchange support staff are calling French crypto holders, telling them their account is compromised and pushing them to move funds immediately to a "secure" wallet that belongs to the crook.
- [2]
Owen Simonin, known as Hasheur, founder and CEO of the French crypto platform Meria, blamed the calls on France's spate of data breaches in a Sept. 20 post on X.
- [3]
"We're going through a phase where data leaks are piling up in private companies as well as in the public sector," Simonin wrote in French, according to X's translation.
- [4]
Simonin said cross-referencing the leaks identifies crypto holders and the platforms they use.
- [5]
Simonin said legitimate support teams do not initiate unsolicited calls demanding transactions or personal details, and contact normally occurs only after a user has opened a ticket about a specific issue.
- [6]
Simonin, founder and chief executive of Meria, says he has received multiple reports in recent days of callers posing as customer-support staff from established exchanges.
- [7]
Callers have impersonated Binance and Meria's own support staff.
- [8]
In mid-August, France's tax authority, the DGFiP, said an intruder used a stolen identity to pull personal and tax records; the breach began in late June and was closed by the end of the month.
- [9]
State cybersecurity agency Cybermalveillance.gouv.fr flagged the pattern on January 22, when its 17Cyber help line was inundated with reports from holders contacted by fake crypto operators or fake bank anti-fraud desks flagging suspicious wallet activity.
- [10]
Some callers posed as police, gendarmes, customs officers or magistrates to fish for recovery seeds and other sensitive material.
- [11]
The Cybermalveillance bulletin noted a preliminary investigation into crypto firm Waltio, run by the Paris prosecutor's cybercrime section and the national gendarmerie cyber unit.
- [12]
In April, Pavel Durov, the founder of Telegram, said France had seen 41 kidnappings of crypto holders in the first three and a half months of 2026.
- [13]
Interior Minister Laurent Nunez said France had recorded 77 kidnappings, unlawful detentions, extortions or attempts linked to crypto by the end of June, compared with 45 in all of 2025.
- [14]
About 200 people have been arrested following attacks or in preventive operations.
- [15]
Phone scams run alongside violent "wrench attacks", in which criminals use physical force instead of hacking to steal coins.
- [16]
Once coins leave a victim's wallet, recovery is rarely possible.
- [17]
About five months separate the January 22 Cybermalveillance bulletin on fake crypto support callers and the late-June start of the DGFiP intrusion.
- [18]
Neither Cryptopolitan nor Crowdfund Insider reported a monetary loss total for the fake-support call campaign.
- [19]
Durov's count of 41 kidnappings through mid-April and Nunez's 77 crypto-linked incidents through end-June imply roughly 36 further incidents in about two and a half months, or some 14 a month.
- [20]
About 200 arrests against 77 recorded crypto-linked incidents is about 2.6 arrests per incident.
- [21]
Estimates of the DGFiP exposure range from 678,000 taxpayers to millions of people, and exposed fields may include names, birth information, addresses, phone numbers, email addresses and tax ID numbers.
- [22]
Officials confirmed that data belonging to hundreds of thousands of taxpayers had been compromised in the August DGFiP incident.
- [23]
If the upper DGFiP estimate of "millions" is read as two million, it is about three times the 678,000-taxpayer floor.
- [24]
Simonin has warned that generative tools will make these campaigns cheaper and more scalable, enabling attackers to automate outreach and refine scripts at speed.
- [25]
Separate reports have described large commercial lists of French crypto users circulating in underground markets.
Sources
2 independent publishers whose own reporting we read for this story.
- crowdfundinsider.comData and Security Breaches in France Lead to Surge in Fake Crypto Support Calls : Analysis
1 article · September 21, 2026
- cryptopolitan.comFrench data leaks help scammers pose as Binance and Meria support staff
1 article · September 21, 2026
Topics and entities
Topics
- Crypto social engineering
- Crypto Physical Attacks
- France Cybersecurity
- Data Breaches
Entities
- Directorate General of Public Finances
- Cybermalveillance.gouv.fr
- Waltio
- Binance
- Telegram