Revolut breach exposed customer data including crypto transaction histories

An unidentified attacker using a spoofed government agency email obtained customer information from Revolut, including identity documents, account statements, and transaction records that include cryptocurrency activity. According to Protos, the attacker is now demanding 10,000 BTC, valued at roughly $780 million, in exchange for not releasing additional customer data.

Revolut disclosed the breach on September 14, describing the incident as a "sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information." The bank stated it detected and blocked the fraudulent email address upon discovery and alerted relevant government agencies, enforcement bodies, data protection authorities, and financial regulators. Revolut confirmed that its systems and customer funds were not affected.

According to Protos, the information potentially disclosed included names, dates of birth, addresses, email addresses, phone numbers, passport copies, and driving license images. Customer notifications reportedly also referenced account statements, IBANs, withdrawal records, and transaction histories, including Bitcoin activity. Revolut declined to specify the number of affected customers, stating only that the count was "very limited."

Former Mt. Gox CEO Mark Karpelès disclosed that he was among those affected, sharing a copy of Revolut's notification indicating his account statements, IBANs, withdrawal records, and full transaction histories including BTC transactions may have been exposed. On-chain investigator ZachXBT has suggested the attackers may have specifically targeted wealthy Revolut customers, with the attack appearing to involve a relatively small number of high-net-worth users, per Protos.

The threat actors have begun publishing customer data and, according to The Daily Hodl, are threatening daily releases until Revolut pays. The attackers have also accused Revolut of negligence around privacy protections and of sharing sensitive information with countries outside its jurisdiction. Cointelegraph reports the attackers are promising to release additional messages, operational insights, and internal data in coming days.

Revolut has not confirmed the ransom demand or authenticated any material circulating online. Crypto analyst Max Karpis, cited by Protos, noted that a 10,000 BTC payment would be easily traced, making it extremely difficult for attackers to cash out, raising questions about whether the ransom demand is credible. Many social media users have expressed skepticism about the demand's authenticity.