Revolut leak sends customer data to hackers

TLDR

Revolut has disclosed that hackers posing as a government agency tricked it into handing over sensitive customer identity and Bitcoin transaction data.

1. Revolut responded to fraudulent data requests sent from a genuine government email domain, exposing KYC documents and full Bitcoin histories for a limited set of customers.
2. The leak ties real-world identities to onchain activity, increasing risks of identity theft, extortion, and targeted physical attacks on crypto holders.
3. Revolut says systems and funds are intact, but affected and non?affected users should expect more spear phishing and regulators are likely to scrutinize how firms verify official data requests.

Deep Dive

1. What Happened At Revolut

Multiple reports say Revolut complied with a fake government request that came from an unauthorized mailbox using a legitimate agency email domain and valid authentication credentials, making it look official to internal checks. Revoluts customer notice and spokesperson confirm that a sophisticated external impersonation scam led to disclosure of names, contact details, copies of passports or drivers licenses, verification selfies, IBANs, account statements, withdrawal records, and full Bitcoin transaction histories for some users, while stating that card details, passwords, private keys, and biometric telemetry were not involved, and that customer funds remain safe. Affected users were contacted directly, but Revolut has not revealed how many people or which countrys agency domain was abused, and onchain investigator ZachXBT suggests the target group skewed toward high?net?worth customers.

Confidence: high because Revoluts spokesperson and several independent outlets report consistent details.

2. Why This Matters For Crypto Users

By combining KYC identity records with detailed Bitcoin (BTC) transaction histories, attackers now have a map between specific wallets and home addresses, occupations, and phone numbers, which significantly raises the risk of sophisticated scams and wrench attacks where criminals pressure individuals offline. Coverage of this incident notes that it has intensified criticism of mandatory KYC rules, as Revoluts leak follows other large?scale customer data exposures at crypto and fintech firms, showing that centralized storage of identity documents and transaction histories can become a high value target. Even if no funds or keys were stolen, identity theft, fraudulent loans, and social engineering to bypass security checks are realistic downstream threats.

3. What To Watch And How To Respond

Revolut says it has blocked the offending email, notified the impersonated agency, regulators, and law enforcement, and is treating this as an external impersonation rather than an internal system breach. For impacted users, the priority is to monitor for unusual contact claiming to be from Revolut or authorities, use in?app chat or official support channels to verify any request, and consider tightening personal security if large holdings are involved. More broadly, expect regulators and firms to revisit how emergency or law?enforcement data requests are authenticated, and expect renewed debate around minimizing stored KYC and transaction data, since similar impersonation could work against other platforms that do not require stringent out?of?band verification.

Conclusion

Revoluts leak shows that even without a technical hack, flawed verification of official data requests can expose detailed KYC files and crypto histories to attackers. For crypto users, the key takeaway is that centralizing identity plus onchain data creates enduring personal risk, so careful verification of communications and awareness of how much information a platform stores are now as important as traditional wallet security.