Waltio January 2026 leak: what was exposed and whether you are at risk

Waltio has confirmed a January 2026 leak of limited 2024 tax-report data. It has not confirmed later claims that this file was used to choose people for home invasions; those links come from court reporting and journalism, not from the company, a victim, or a regulator. According to its 23 January 2026 security notice, an attacker on the night of 21 January 2026 reached data used to build 2024 tax reports (as of 31 December 2024). For complete reports, Waltio said that included the user’s email address plus combined 2024 gains and losses and how much crypto they held at year-end; incomplete reports had even less. The company said passwords, wallet addresses, bank details, identity papers and home addresses were not exposed, that nobody could move funds with this file, and that it told France’s privacy regulator and filed a complaint. News outlets have often cited about 50,000 users, a figure Waltio called “plausible” without publishing its own count.

According to Cryptoast, citing local court coverage, a failed armed attempt on 5 June 2026 in Ételfay was discussed at the Amiens court as having been aimed using data from the January Waltio incident circulating on illegal online markets. A later compilation citing Le Parisien described another attempted break-in and detention on 21 July 2026 in Bry-sur-Marne. France’s interior minister has been reported as counting 77, or more than 70, crypto-linked kidnappings, detentions and extortion attempts in 2026 — a national tally, not a count of Waltio victims. Waltio’s chief executive, Pierre Morizot, has said there is no link between the January hack and that wider wave; the company’s lawyer had earlier said isolated links could not be ruled out.

The part that sounds reassuring, and what it actually means for you

Most coverage leads with what was not taken: no passwords, no wallet keys, no home address, no way to empty an account. That is what Waltio reported, and it matters. It is also not the question most people are actually asking.

What the attacker is described as holding is closer to a shopping list than a bank login. An email address sitting next to a number — this person held this much crypto at the end of 2024 — tells a criminal who is worth looking up, not how to open their account. Home addresses, according to both Waltio and later reporting, were not in the original file. Getting from an email to a doorstep takes extra work: public people-search pages, other old leaks, phone listings, anything that turns an email into a name and a building. Some journalism, including coverage of a Nancy case involving people posing as police, has explicitly tied individual attacks to Waltio-derived information after that kind of extra matching. That chain has not been confirmed by a prosecutor, by the privacy regulator, or by Waltio, and it should not be treated as proven for the two cases above.

The honest read is narrower than the scariest headlines and less comforting than “your address was never in there.” If you filed a 2024 report through Waltio, someone may now know a contact email and a snapshot of how much crypto was on that report. That does not put them on your street by itself. In a year when French officials have counted dozens of physical crimes against crypto holders, it is still a reason to be harder to look up, and to treat anyone who already knows your 2024 numbers as hostile.

What to actually expect

• Fake emails or messages that mention 2024 gains, losses, or a year-end balance, or that pretend to be Waltio, the tax office, or the privacy regulator offering to “check” or “freeze” your file. Waltio itself has said this kind of trick is the main risk from its file.
• No trustworthy public tool can tell you whether your Waltio report was in this incident. Typical breach-check sites do not hold this dataset. A clean result is not proof you were spared, and nobody honest can run that check for you.
• If your report was complete, those 2024 figures attached to an email may already be circulating and being resold. Media have repeated a roughly 50,000-user estimate; there is no public split between complete and incomplete reports.
• A knock on the door is not the normal next step for everyone on such a list. Reported physical attempts have been described as using older or cheap criminal databases after extra matching, not as Waltio handing over an address book. Officials have not confirmed that complete path for the two cases most often cited.

What you can and cannot fix

If a complete 2024 Waltio report included your email and those year-end totals, that pairing cannot be taken back. It cannot be deleted from illegal markets. Anyone promising to remove you from the breach cannot do that. According to Waltio and later reporting, home addresses, legal names, phone numbers and identity documents were not in the original leak — so those items were not released by this file. They can still be added from elsewhere.

• Treat anyone who already knows your 2024 crypto totals as a stranger trying to trick you. Do not click their links, do not share codes, do not “verify” a wallet or pay a fee to lock the file.
• Pull your household off people-search and directory sites. That is the real lever. A bare leaked line — an email and a balance — becomes dangerous when it is joined to listings that add relatives, phone numbers, employers and old addresses. Those listings, unlike the leaked tax file, can actually be taken down.
• Make the email on that tax report harder to use as a key to the rest of your life. Change its password if it is reused anywhere, turn on the extra login step your email provider offers, and stop using that address on forms that reveal where you live.
• Do not confuse this one file with the wider problem. French officials have counted around 70 to 77 crypto-linked physical crimes in 2026. Being careful about who knows you hold crypto is sensible. It is not evidence that Waltio published your address, which the company says it never held.