Revolut Breach Exposes Passports, Bitcoin Histories After Spoofed Government Email

Revolut fulfilled a fraudulent data request sent from a spoofed government agency email domain, exposing customer identity documents, contact information, and full Bitcoin transaction histories to an unauthorized actor. The message carried valid domain authentication credentials, causing Revolut to treat it as genuine and comply with the request.

The exposed data included full identity details: name, date of birth, and occupation. Contact information included postal address, email, and phone number. Document verification data included a copy of the victim's passport or driver's license and selfie provided during KYC verification. Revolut said no biometric facial telemetry data was involved.

Financial data exposed included account statements with IBAN and wallet reference numbers, withdrawal records, and full transaction history including Bitcoin. This combination of personal identity, contact, and crypto transaction data creates material risk for targeted theft or physical attacks.

Revolut confirmed the breach in a statement to Decrypt: a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information. The company said a limited number of customers were affected, disabled the email address, and alerted the agency, law enforcement, and regulators. Revolut stated systems and customer funds were unaffected.

Revolut declined to disclose how many people were hit or which agency was impersonated, limiting public assessment of breach scope. Crypto security researcher ZachXBT said the incident appeared to target high-net-worth users and raised concern given a surge in violent wrench attacks against known crypto holders. Several users on social media argued the episode shows know-your-customer rules have created risk without meaningful benefit.

The breach joins a rough stretch for firms holding crypto users' personal data. Hardware wallet maker Trezor recently saw a support-vendor breach widen to expose tens of thousands of additional customers, and X appears to have suffered its own data breach prompting widespread password resets.

The Bottom Line: Revolut's refusal to disclose the number of affected customers or which agency was impersonated limits assessment of whether exposed contacts have already entered phishing or physical-theft targeting pipelines. The incident demonstrates that domain authentication alone is insufficient protection against social-engineering attacks on custodians holding consolidated KYC data.