preferred on
Points of Focus
- Revolut leaked customer IDs and account data after a fake government request.
- ZachXBT says the leak included full Bitcoin transaction histories.
- The breach comes days after Revolut’s conditional US bank charter approval.
Revolut confirmed to TechCrunch that it disclosed sensitive customer data to an unauthorized third party after a fraudulent request, sent from a legitimate government agency email domain, tricked the fintech’s systems into treating it as genuine. The exposed data included passports, driver’s licenses, verification selfies, home addresses, and account statements for a ‘limited’ number of customers.
LATEST: 🚨 Revolut confirmed it suffered a data breach after a "sophisticated external impersonation scam" in which attackers used a real government email domain to obtain customer ID documents and personal data. pic.twitter.com/vcDmwsyEcM
— CoinMarketCap (@CoinMarketCap) September 14, 2026
Onchain investigator ZachXBT said in a Telegram post that the leaked data included ‘full transaction history including Bitcoin,’ along with IBAN and withdrawal records, and that the incident appears targeted at high-net-worth users. That detail turns what reads elsewhere as a routine KYC leak into something more specific for crypto users: a name-and-address map of who holds meaningful Bitcoin.
How the fake government request tricked Revolut’s systems
Revolut told TechCrunch it had identified ‘a sophisticated external impersonation scam’ in which an unauthorized third party used a legitimate government agency’s email domain to submit fraudulent information requests. The company said it blocked the address after discovering the scam and alerted the impersonated agency, law enforcement, and financial regulators.
Revolut has not disclosed which government agency was spoofed, which market the incident affected, or how many customers were hit. The company said its systems and customer funds are unaffected, and it has more than 80 million customers across over 30 countries.
The incident has since escalated. Attackers began publicly posting stolen data this week and are demanding payment from Revolut, saying on Telegram they plan to keep releasing more each day, according to posts circulating on X. Some of that material reportedly involves high-profile and crypto-linked customers, though Revolut has not addressed the extortion attempt publicly.
‼️ BREAKING: The threat actors who targeted Revolut with information-demand emails are now posting sensitive customer data, including that of high-profile clients such as tennis player Shevchenko and Römer, CEO of Gamdom/Skinscom.
They want Revolut to pay up. They say they'll… pic.twitter.com/obuVOOABx7
— International Cyber Digest (@IntCyberDigest) September 13, 2026
Why the Bitcoin detail raises the stakes for Revolut’s crypto users
Revolut’s crypto exposure is not incidental.
The fintech holds a Cyprus-issued Markets in Crypto-Assets (MiCA) license, runs a standalone exchange called Revolut X offering more than 200 tokens, and lets customers custody and withdraw crypto from its main banking app. That is a large base of identity-verified customers with onchain balances tied to their real names.
Pseudonymity is the main privacy protection most Bitcoin holders rely on: a wallet address alone does not reveal who controls it. A breach that pairs verified identity documents and a home address with transaction history removes that protection for whichever customers were affected, the exact combination security researchers describe as the setup for a so-called ‘wrench attack,’ physical coercion of a known crypto holder rather than an online hack.
That risk has a documented precedent. Coinbase disclosed in May 2025 that overseas customer-support contractors had been bribed to leak customer names, addresses, and account data, then tried to extort the exchange for $20 million instead of releasing it. Coinbase refused to pay, instead offering a $20 million reward for information on the attackers, and estimated the total cost of the breach at up to $400 million.
Revolut’s breach lands during its push for a US bank charter
The disclosure comes days after the US Office of the Comptroller of the Currency granted Revolut conditional approval, on Sep. 3, to establish a national bank, which the company expects to launch in the first half of 2027. Revolut is also reportedly weighing a public listing that could value the firm at as much as $200 billion, up from a $75 billion private valuation in November.
A breach involving government impersonation and identity documents is a different category of scrutiny for a company mid-application with US federal banking regulators than a routine phishing incident would be. Neither the number of affected customers nor the identity of the impersonated agency has been confirmed, and Revolut said only that it is cooperating with the relevant regulators as its investigation continues.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency prices are highly volatile. Always conduct your own research before making investment decisions.
Share
Most read articles
