- Trending
- Comments
- Latest
Revolut has confirmed a data breach that exposed customer identity documents, verification selfies and transaction histories, including Bitcoin activity, after attackers used a fraudulent mailbox inside a legitimate government agency’s domain to trick the fintech into handing over customer data. The incident has since escalated into an extortion attempt, with hackers threatening to leak more records unless Revolut pays a ransom.
The attackers did not need to break directly into Revolut’s core banking systems. Instead, they used an unauthorised mailbox created within the infrastructure of a legitimate government agency and sent fraudulent requests for customer information.
Because the requests appeared to come from an official government source and carried valid domain authentication credentials, Revolut initially treated them as genuine. The company later discovered that the mailbox was unauthorised and blocked the address.
Revolut said it also alerted the relevant government agency, law enforcement authorities, data protection authorities and financial regulators.
The incident shows how a social engineering attack can bypass some of the protections surrounding a financial institution without requiring criminals to penetrate its main systems.
The breach has a significant cryptocurrency angle because some of the affected records reportedly included full transaction histories, including Bitcoin transactions.
Customer notices also listed identity documents, verification selfies, account statements, IBANs and withdrawal records among information that may have been disclosed.
That combination could create a bigger risk than the exposure of ordinary contact information. A Bitcoin transaction is recorded publicly on the blockchain, but identifying the person behind a wallet can be much harder.
If criminals obtain both a customer’s identity documents and information about their cryptocurrency activity, they may have a clearer picture of who controls particular funds and how much activity is taking place.
The incident therefore adds another dimension to the wider problem of crypto security.
The attackers have reportedly moved from stealing the information to using it as leverage against Revolut.
A group identifying itself as Revolut Smilik has reportedly issued threats through Telegram, warning that more customer information will be published if the company does not pay. The exact ransom amount has not been confirmed by Revolut.
Reports have circulated claiming the attackers are demanding 10,000 BTC, but that figure remains unconfirmed and should not be treated as an established fact.
Some stolen customer records have reportedly already been posted, turning the incident from a private data-security investigation into a public extortion campaign.
Revolut has said that the incident was not a direct compromise of its core infrastructure. The company said its systems and customer funds were unaffected and that it had taken precautionary measures after discovering the fraudulent requests.
It has not disclosed the exact number of affected customers or identified the government agency whose domain was used. The company has instead described the incident as a sophisticated external impersonation scam which is important because the incident did not follow the traditional pattern of hackers breaking into a database and stealing information directly.
Instead, the attackers exploited trust in an official communication channel.
The data breach comes as Revolut continues to expand its banking and cryptocurrency operations.
The London-based fintech has more than 80 million customers globally and is seeking to increase its presence in the US financial market.
The company recently received conditional approval for a US national banking charter, adding further importance to questions surrounding its security and compliance systems.
For a financial platform operating across banking, payments and cryptocurrency, customer information can be highly valuable even when customers’ money itself is not stolen.
The exposure of identity documents alongside transaction information could potentially make future phishing, impersonation and targeted crypto scams easier to carry out.
The incident also comes as the cryptocurrency sector faces growing scrutiny over how exchanges and fintech companies collect and protect KYC information.
The Bit Gazette previously reported on the Coinbase biometric privacy case, another case stated the increasing importance of biometric and identity data in the digital-asset industry.
The Revolut breach reveals a problem that extends beyond passwords and private keys.
A customer can protect a crypto wallet properly and still face risks if criminals obtain the personal information connecting that wallet activity to their real identity.
This makes KYC data increasingly valuable.
Identity documents, addresses, phone numbers, facial verification images and transaction records can provide criminals with information that may later be used to impersonate a customer or create highly targeted scams.
That risk is particularly important for high-value crypto users.
Blockchain investigator ZachXBT said the incident may have been targeted at users with significant wealth, although that remains his assessment rather than a confirmed finding from Revolut or law enforcement.
The wider crypto industry has already seen how attackers can combine social engineering with stolen information to target people who control digital assets.
The deepfake multisig attacks previously reported by The Bit Gazette show another version of the same problem. Criminals increasingly target the people and processes surrounding digital assets rather than simply trying to break blockchain technology itself.
The immediate question is how the fraudulent request passed Revolut’s verification process. Financial institutions regularly receive legitimate requests from governments and law enforcement agencies for customer information.
That makes the ability to distinguish a genuine request from an attacker using compromised government infrastructure particularly important.
In Revolut’s case, the fraudulent request appeared to come from an authentic government domain and carried valid authentication credentials, according to the company’s explanation.
The company now faces the task of determining how the request was accepted, how much information was released and whether the stolen data can be recovered or further publication prevented.
For affected customers, the concern is no longer limited to whether money was taken from their accounts.
Their personal information may now be in the hands of criminals who could use it for further fraud.
Protecting digital assets once focused heavily on private keys, wallets and transaction approvals. Today, the information surrounding those assets can be just as important.
A stolen passport may not immediately move Bitcoin. But when combined with a customer’s transaction history, phone number and other personal details, it can provide criminals with the information needed to launch a more convincing attack.
For Revolut, the incident is now a race between containing the exposed information and preventing criminals from turning that information into further financial crime.
For crypto users, it is another reminder that protecting digital assets means protecting the identity attached to them as well.
The company has not confirmed the number of affected customers or the amount demanded by the attackers, leaving important questions about the full scale of the incident still unanswered.
Copyright © 2025 - The Bit Gazette.
