Phone scammers are targeting French cryptocurrency holders by impersonating support staff from major exchanges, and Meria founder Owen Simonin attributes the latest wave of fraud calls to France's string of data breaches.

Simonin, who is also known as Hasheur, laid out the scheme in a Sept. 20 post on X.

Scammers impersonate Binance and Meria staff

According to Simonin, the caller claims to work for a legitimate exchange — sometimes Binance, sometimes Meria itself — and tells the target that their account has been compromised. The promised fix is to move funds straightaway to a “secure” wallet, one that actually belongs to the crook. Because blockchain transfers cannot be reversed, anything sent to an address the caller controls is effectively out of the victim's hands.

Simonin urged holders to treat urgency as the warning sign. A legitimate service will not call out of the blue unless the user first contacted it about a specific issue, let alone ask for a transaction or personal details, he said. He also expects artificial intelligence to make such calls quicker.

“We’re going through a phase where data leaks are piling up in private companies as well as in the public sector,” Simonin wrote in French, according to X’s translation. Cross-referencing those leaks can identify crypto holders and the platforms they use, he added.

DGFiP breach exposed taxpayer records

Cryptopolitan reported in mid-August that France's tax authority, the DGFiP, said an intruder used a stolen identity to pull personal and tax records. The breach began in late June and was closed by the end of that month.

Estimates of exposure range from 678,000 taxpayers to millions of people. Exposed fields may include names, birth information, addresses, phone numbers, email addresses, and tax identification numbers — including the phone numbers and email addresses that give a scammer a direct line to a target.

Cybermalveillance logged the same pattern in January

State cybersecurity agency Cybermalveillance.gouv.fr flagged the pattern on January 22. Its 17Cyber help line was inundated with reports from holders contacted by fake crypto operators or fake bank anti-fraud desks claiming suspicious wallet activity.

Callers maneuvered assets into fraudulent wallets. Some posed as police, gendarmes, customs officers, or magistrates to fish for recovery seeds and other sensitive material. The bulletin also noted a preliminary investigation into crypto firm Waltio, run by the Paris prosecutor’s cybercrime section and the national gendarmerie cyber unit.

Phone scams accompany violent wrench attacks

Phone scams run alongside violent “wrench attacks,” in which criminals use physical force rather than hacking to steal coins. In April, Telegram founder Pavel Durov said that France had seen 41 kidnappings of crypto holders in the first three and a half months of 2026.

Interior Minister Laurent Nuñez said France had recorded 77 kidnappings, unlawful detentions, extortions, or attempts linked to crypto by the end of June, compared with 45 in all of 2025. About 200 people have been arrested following attacks or in preventive operations. Read together, the January bulletin, the DGFiP disclosure, and Simonin's September warning trace a year in which remote fraud and physical coercion developed side by side — and the preliminary Waltio probe and the ministry's running incident counts are the figures to watch next.