02/09/2026
Which part of the crypto sector do attackers actually target?
Most security teams would say exchanges and wallets, and in part they would be right, but not completely.
We monitored the principal underground forums and several private Telegram channels for twelve months and measured where French crypto targeting mentions concentrate.
In the data we found very interesting nuggets, including:
1. Tax and accounting services sit third, at 14 percent of mentions, ahead of authorised providers and brokers. Not because of what they do, but because of what they hold. Email addresses combined with tax reports yield gains, losses and aggregated balances, which is a pre-sorted list of holders with a wealth estimate attached.
2. Centralised exchanges account for 38 percent and wallets for 21 percent, so the predictable targets still dominate the volume.
3. The chain feeding all of it is specialised across four roles, with a re-victimisation loop that sells lists of already defrauded victims back into the acquisition phase, priced on their conversion rate.
Read the threat note, by Alix Avezou:
Read the findings of our investigation into the compromise and exploitation of data belonging to French crypto-asset holders and providers.
