Hackers have demanded a ransom from the French cryptocurrency company Waltio after gaining access to some of its users’ data.
Ce vendredi matin, nous avons déposé plainte pour tentative d’extorsion et atteinte à un système de traitement automatisé de données.
Le 21 janvier 2026, nous avons été destinataire d’une tentative d’extorsion. Celle-ci semble faire suite à une attaque particulièrement…
— Waltio (@Get_Waltio) January 23, 2026
“On January 21, 2026, we were the target of an extortion attempt. This appears to have followed a particularly sophisticated attack that allowed access to certain company data,” the statement reads.
The platform offers the ability to calculate capital gains tax on digital assets.
According to the newspaper Le Parisien, hackers from the Shiny Hunters group stole data from 50,000 accounts. Waltio serves approximately 150,000 users.
The company assured that the breach is not related to an infrastructure hack—services are operating normally, and client data remains secure.
The perpetrators obtained tax reports for 2024, which include the account holder’s email address, profits or losses, and asset balances at the end of the period. Most records contain even more limited information.
According to Waltio, the breach did not affect: passwords, exchange API keys, wallet addresses, transaction history, bank accounts, or other data that would allow funds to be moved. The company’s CEO, Pierre Morizot, emphasized that clients do not disclose any information to the platform other than their email addresses.
He noted that the main risk of the incident lies in potential fraud through social engineering methods. Hackers could resort to phishing, contacting users while posing as support staff.
“Some perpetrators may use contextual elements (such as the presence of a tax report or summary information) to appear convincing,” Morizot added.
He recommended verifying the authenticity of emails from Waltio by checking the security code and not responding to calls and SMS from supposed company specialists—they do not have clients’ phone numbers.
In 2025, the total value of cryptocurrencies stolen through phishing attacks decreased by 83% to $83.85 million, according to SlowMist.