State-Sponsored Doxing
A Paris court has rejected the release appeal of Ghalia C., a 32-year-old former tax agent accused of compiling “hit lists” of high-net-worth individuals for organized crime rings. The Bobigny-based official allegedly used the government’s internal “Mira” software to harvest home addresses of cryptocurrency specialists and investors, selling the data to gangs specializing in violent extortion.
Prosecutors revealed the mechanism during the January 6 hearing: Ghalia C. exploited her clearance level to bypass privacy protocols, targeting specific wealth profiles. Her search history reportedly included queries for billionaire Vincent Bolloré, prison guards, and known crypto holders. The price for this state betrayal? Investigators found she received as little as €800 per dossier via Western Union and cash drops.
The Montreuil Precedent
The danger is not theoretical. The investigation began after a September 2024 attack on a prison guard in Montreuil. Using an address supplied by Ghalia C., three armed men stormed the guard’s home to settle a score related to contraband phones. The court cited this proven link between her data leaks and physical violence as the primary reason for denying her bail. She remains detained on charges of criminal conspiracy and complicity in violence.
“She refused to give her phone passcode and the name of the person who hired her; that’s criminal behavior. This woman abused her position in a completely abnormal manner to serve a hardened criminal,” the Public Prosecutor stated.
Institutional Context: The ‘Wrench Attack’ Surge
The timing of the court’s decision coincides with a sharp rise in physical crypto thefts across France. On the same day Ghalia C. was denied bail, masked gunmen in Manosque held a woman captive to seize a USB drive containing her partner’s private keys. Security researcher Jameson Lopp has documented 14 such physical attacks in France recently, making it a global hotspot for “wrench attacks.”
For French investors, the implication is chilling: the threat vector is no longer just on-chain phishing or smart contract exploits. It is the tax declaration itself.
