Revolut data leak exposes Bitcoin transaction histories

TLDR

Revolut has suffered a data leak where a fraudulent government-style request led it to expose some customers identity data and full Bitcoin transaction histories.

1. A sophisticated impersonation scam using a real government email domain tricked Revolut into handing over passports, KYC data and complete Bitcoin records for a limited group of users.
2. The leak did not include private keys or passwords, but it links names and home addresses to detailed Bitcoin activity, increasing risks of targeted extortion and physical threats for affected holders.
3. Users should monitor Revoluts remediation steps, regulatory fallout, and tighten personal security, as the incident highlights systemic risk in how KYC plus crypto data are stored and shared.

Deep Dive

1. What Was Exposed

Multiple reports say Revolut responded to a request that appeared to come from a government agency, sent from an unauthorized email account using the agencys real domain and valid authentication credentials, and treated it as legitimate when releasing data. The notification sent to customers admits that exposed records included passport or drivers license copies, verification selfies, full names, dates of birth, contact details, IBANs, wallet reference numbers, withdrawal records and full Bitcoin transaction histories for some users, as confirmed by outlets like Decrypt and Crypto.news.

Revolut has described the incident as a sophisticated external impersonation scam, said a limited number of customers were affected, and stated that its systems and customer funds were not compromised, according to a spokesperson quoted by The Block. Exact customer counts and the agency involved remain undisclosed.

2. Why Linking Identity To Bitcoin History Matters

The most serious issue is not account access but linkage. The attacker now has, for some users, both real-world identity data and detailed Bitcoin transaction histories. This gives a map of who holds meaningful BTC and where they live. Chainalysis recently reported that violent attacks against crypto holders, including home invasions and kidnappings, have surged, with more than 30 million dollars extracted from victims in 2026 and home invasions rising to 37 percent of such incidents, as cited in recent coverage.

Although reports stress that private keys, passwords and card details were not shared, spear phishing, extortion attempts and wrench attacks (coerced transfers under physical threat) become much easier when attackers can tie a verified identity to a BTC-rich history.

3. What To Watch Next

Revolut has blocked the fraudulent email, notified the impersonated agency, law enforcement and regulators, and contacted affected users individually, but has not publicly detailed numbers, jurisdictions or procedural changes. Regulatory responses, particularly from data protection authorities, may force tighter standards for authenticating government data requests and handling crypto-related KYC files across the industry.

For Revolut customers, the practical steps are: closely watch account and email activity, treat any contact referencing detailed personal or Bitcoin information with skepticism, and use in-app support and official channels to verify messages before acting. Longer term, expect more scrutiny of how fintechs store, aggregate and respond to requests for crypto transaction data.

Confidence: high because multiple independent outlets and Revoluts own notice align on the core facts, although scope and exact victim counts remain unclear.

Conclusion

Revoluts leak shows that the weak point in crypto data security can be institutional handling of identity and transaction records, not the blockchain itself. By tying verified identities to full Bitcoin histories, the incident increases targeted risk for a subset of users and underscores that KYC plus detailed onchain activity is a powerful dataset. The key forward-looking question is whether regulators and firms tighten verification and data minimization enough to reduce the chance that similar impersonation scams end with another leak of crypto holders real-world identities.