A teenager in the Tarn department of southwestern France believed a virtual private network would keep him anonymous while he phoned in fake bomb threats and orchestrated swatting incidents against schools and local authorities. He was wrong. The Gendarmerie nationale announced on October 11, 2026 that the minor had been identified and will face the children's court, the tribunal pour enfants, over thirteen separate incidents committed between March 2025 and June 2026, most of them concentrated around Gaillac.
The gendarmerie summarised the outcome bluntly in a post on X: "He thought he was protected by his #VPN but he was unmasked by the gendarmes of the Tarn. Thirteen. That's the number of fake bomb threats and swatting incidents that targeted schools and local authorities in the Tarn for over a year."
The investigation was carried out jointly by the Brigade de recherches de Gaillac, the Toulouse branch of the Unité nationale cyber, and the C3N, the national centre for combating digital crime. How the suspect was ultimately traced has not been disclosed.
A familiar illusion
The case fits a pattern that has played out repeatedly with tools marketed as untraceable, including cryptocurrency mixers. Bitcoin's ledger has been public and permanent since January 2009, a transparency that has undone several operators of anonymity services built on top of it. Roman Sterlingov, who ran the mixer Bitcoin Fog from 2011 to 2021, was sentenced in November 2024 to 12.5 years in prison after investigators traced transactions through the blockchain itself. Roman Storm, developer of the Ethereum mixing service Tornado Cash, was found guilty in August 2025 of conspiracy to operate an unlicensed money transmitting business, though the jury did not reach a verdict on a separate money laundering charge; a new trial is reportedly scheduled for April 26, 2027, according to The Block.
Privacy-focused coins have faced a parallel squeeze from exchanges. OKX delisted Monero on January 5, 2024, and Binance followed on February 20, 2024, removing two of the largest venues where the privacy coin could be traded.
Brussels closes the remaining gaps
European regulation is moving in the same direction. Since December 30, 2024, EU rules have required crypto platforms to identify the sender and recipient of transfers, with additional verification applying to transfers to personal wallets above 1,000 euros. From January 1, 2026, the DAC8 directive has obliged platforms to collect client data for tax authorities. The EU's anti-money laundering regulation, the AMLR, goes further still: from July 10, 2027, platforms will be barred from offering privacy-masking crypto assets altogether.
For a European minor who assumed a VPN subscription was enough to shield him from gendarmes, the gap between the promise of anonymity and its technical reality proved costly. The same gap is closing for anyone relying on crypto mixers or privacy coins to achieve the same result within the EU.
