Revolut breach: attackers use government email spoofing to steal customer crypto records

UK fintech Revolut disclosed a data theft affecting a "very limited" number of customers after attackers impersonated a government agency to bypass its information-request controls. According to Protos, the attackers used a legitimate government domain to submit fraudulent requests for customer information and succeeded in extracting personal identity documents, account data, and transaction records.

The breach exposed more than just routine account data. Customer notifications from Revolut, per Protos reporting, referenced account statements, IBANs, withdrawal records, and full transaction histories, including Bitcoin activity. Personal documents reportedly stolen include passport copies and driving licenses. Protos also reported that some affected customers may be high-profile or high-net-worth individuals, a detail supported by on-chain investigator ZachXBT, who suggested the attackers may have specifically targeted wealthy Revolut users.

Former Mt. Gox CEO Mark Karpelès confirmed his account was among those affected, sharing a copy of a Revolut notification stating that account statements, IBANs, withdrawal records, and full transaction histories including BTC transactions may have been exposed.

Threats followed the theft. According to Protos, the attackers are seeking 10,000 Bitcoin in exchange for not releasing additional customer data, which at current prices equates to roughly $780 million. The threat actors have begun publicly posting sensitive customer data and threatening daily releases, per The Daily Hodl. The Daily Hodl also reported that the threat actors have accused Revolut of negligence around privacy protections and of sharing sensitive information with countries outside its jurisdiction.

Revolut responded with a statement: "Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information. Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators. Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support." The company has not confirmed the authenticity of the ransom demand or authenticated any material circulating online, per Protos.

Several observers questioned the credibility of the ransom threat. Protos reported that crypto analyst Max Karpis noted that a 10,000 BTC payment would be easily traced, making it extremely difficult for attackers to cash out, and that many social media commenters expressed doubt the ransom demand is real. The company's assertion that systems and customer funds remain unaffected suggests the incident is primarily a data disclosure rather than a breach of trading systems or direct access to held crypto.

Revolut has not disclosed the exact number of affected customers, offering only a "very limited" characterization.