Tax Hacking: 16-Year-Old Hacker Charged, His Tools Also Threaten Crypto Holders

Sixteen years old, and already two charges. Le Monde reports that the teenager nicknamed "Casquette" was charged on Wednesday, October 28, in the investigation into the hacking of the DGFiP. Corneille thought of Rodrigue. Justice is now targeting a boy from Bouches-du-Rhône, suspected of helping to siphon data from 678,000 taxpayers.

For crypto holders, the case goes far beyond the tax authorities. The duo targeted by the judges sold an infostealer that siphons passwords and wallets from infected computers. The files stolen from Bercy also provide the names, addresses, and incomes of hundreds of thousands of French citizens. We detailed this risk as soon as the hacking of the DGFiP was announced.

Key Points

• A 16-year-old minor, alias "Casquette", joins ChatNoir on the bench of the accused.
• Investigators see this duo as the two heads of the ZeroBytes group.
• Their former gang, Epsilon, sold an identifier thief to other hackers.
• The access of tax agents was precisely stolen by this type of software.

Tax Hacking: Casquette's Police Custody

The Anti-Cybercrime Office (OFAC) placed him in police custody on Tuesday, October 27, on the commission of the investigating judges. The next day, the judges charged him with fraudulent extraction of data from a state system in an organized group. This includes unauthorized access and maintenance in the same system.

He was 15 years old at the time of the facts.

The Paris prosecutor's office had requested judicial control, and this is what the magistrates retained. His lawyer, Me Réda Ghilaci, describes the charge as "particularly fragile". He plans to contest it in the coming days.

Casquette is not unknown to the authorities. He had already been in police custody at the end of August at the cyber brigade of the Paris police prefecture. On September 4, he was charged in another procedure targeting the Epsilon group.

His alleged accomplice ChatNoir (18 years old) has been in pre-trial detention since the summer in the tax case. He was already under judicial control for the hacking of Free in 2024 when the intrusions at Bercy began.

An Infostealer Behind the Tax Hacking and Wallets

Under the Epsilon banner, the duo resold an infostealer to other cybercriminals. The judges also attribute the hacks of Shadow and LDLC to them between 2023 and 2024. Several X accounts of newsrooms have passed through their hands, including that of BFMTV.

The principle is brutally simple. Once on the machine, the program copies the passwords stored by the browser and transmits them to its operator. On a machine that is also used to manage cryptos, the harvest includes wallet extensions, open exchange sessions, and sometimes a seed phrase forgotten in a text file.

It was through this door that Bercy fell. The report from Anssi published on September 29 estimates that several dozen identifiers of agents were "probably siphoned by infostealers". The tax authorities did not manage these computers. Two portals had no strong authentication, and about 14 GB of data were extracted in three months without triggering an alert.

The method is also increasingly paying off in crypto. According to figures from Chainalysis relayed by The Block, personal wallet compromises reached 158,000 cases in 2025. At least 80,000 victims lost 713 million dollars. The analyst notes that attackers are now targeting smaller amounts from more users. In 2024, individuals lost 1.5 billion dollars.

Tax Hacking: What the Stolen Files Offer to Robbers

The lot stolen from the DGFiP contains 392,867 individuals and 285,570 professionals, with the reference tax income, address, and family situation. For a robber looking for a wealthy home to visit, it's a directory. Anssi specified at the end of September that no aggression had yet been linked to these files. ZeroBytes claims to have sold part of the data to two buyers for a few thousand euros.

The state wants to impose strong authentication on its administrators before December 31, 2026, and then on all its agents before February 2028. Our analysis of the Anssi report on the tax hacking detailed this timeline. Until then, two-factor authentication on your exchanges and a hardware wallet remain your best defense against an infostealer.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.