A name, a phone number, a licence plate or an IBAN: on Reacher, any one of these was enough to retrieve what hundreds of data leaks contained about a person. On 6 October, officers from France's anti-cybercrime office (OFAC) took the site offline and arrested its three administrators, all aged 17. The French National Police detailed the operation on 14 October.

How Reacher worked

Reacher belongs to a category of services known in the field as “lookups”. The principle is simple: the user enters an identifier, and the site cross-references databases taken from leaks to return everything linked to it. According to the National Police, the platform, created in March 2026, claimed 730 million indexed rows of data and more than 3 million searches. It had been renamed Stryx at the start of the summer.

Access was free or by subscription, with credits to buy in order to run more queries. Police describe it as a first in France for this type of site.

The investigation began with a report from the association e-Enfance on 15 May. The three minors are being prosecuted for, among other things, handling fraudulently extracted data as an organised gang. They face up to ten years in prison, and a trial is scheduled for January 2027. They remain presumed innocent until that judgment.

A clear limit must be set first: at this stage, nothing links Reacher to any specific attack on a cryptocurrency holder. The connection lies in the modus operandi.

According to figures from the French Ministry of the Interior passed on to Cointelegraph and reported by Journal du Coin, 90 violent incidents linked to cryptocurrencies (kidnappings, false imprisonment, extortion) were recorded between 1 January and mid-August 2026. Investigators favour one line of inquiry: victims being identified on the basis of their personal data.

The reasoning described by Journal du Coin works in two stages. A leak at a crypto service reveals who holds digital assets; the Waltio leak, in January 2026, exposed around 50,000 users. A lookup service can then complete the picture with an address, a phone number, sometimes a vehicle. Taken in isolation, each leak seems harmless; it is cross-referencing them that creates the risk.

Other services remain active

The closure of Reacher does not solve the underlying problem. According to Police & Réalités, cited by Journal du Coin, another service, BrixHub, claims 11 billion pieces of data. Reported to the judicial authorities on 5 October, it was still online when the source article was published.

Another point to watch: the seized files also contain the data of Reacher's customers, which investigators are analysing. Some users could therefore be prosecuted in turn. Five months passed between the report in May and the arrests in October.

Limiting your exposure

The case is French and the source does not mention any victims in Switzerland. The mechanism, however, does not depend on a country: leaks circulate online and crypto platforms have an international customer base. A few habits, which here are a matter of analysis rather than investigation, help reduce the exposed surface.

Stay discreet about your holdings. Do not publicly mention the amounts you hold, whether on social media or in exchanges with strangers. A leak only reveals what was entrusted to a service; what is published voluntarily, on the other hand, is accessible to everyone.

Compartmentalise your contact details. Using an email address dedicated to crypto platforms makes it harder to link it to the rest of your digital identity.

Be wary of messages that follow a leak. Stolen data is also used to make phishing attempts credible: a message that mentions your name, your platform or a transaction is no proof of authenticity. It is better to log in directly to the service concerned rather than follow a link you have received.

React if you are notified. If a service announces a leak affecting you, change the passwords concerned, enable two-factor authentication and stay alert to unusual requests.

These measures do not remove data already in circulation. They do, however, reduce the amount of information a third party can assemble from a single search.

Sources

  • Journal du Coin: “Crypto-kidnappings: police shut down Reacher, a stolen-data engine run by 3 teenagers”