Revolut exposed Bitcoin records after fake agency request

Revolut disclosed personal data and Bitcoin transaction histories after responding to a deceptive request that seemed to originate from an official government email domain. The company later confirmed the request was unauthorized.

How the fake request was delivered

The request arrived from an email account that used a legitimate government agency’s domain and passed domain authentication checks. Revolut believed the request was genuine and complied, providing the requested information.

Data that was disclosed

The disclosed material included:

• Full names, dates of birth, occupations, postal addresses, email addresses and telephone numbers
• Copies of identity documents such as passports or driver’s licences and verification selfies
• Account statements showing IBANs, account status, opening dates and Bitcoin wallet reference numbers
• Withdrawal records and complete transaction histories, including Bitcoin transactions

The notice did not indicate that private keys, passwords or full payment‑card details were shared.

Scope and target of the breach

On‑chain investigator ZachXBT suggested the incident may have been limited and possibly targeted high‑net‑worth users, though Revolut has not confirmed the size of the affected group or the selection criteria.

Potential impact for customers

The UK Information Commissioner’s Office warns that breaches of this nature can lead to identity theft, fraud and financial loss. Affected individuals now have personal identifiers linked to detailed financial activity, including cryptocurrency transactions.

Regulatory and company response

Revolut’s notice does not state whether it has reported the breach to regulators or the timeline of its internal discovery. The company’s U.S. security guidance advises customers to verify contacts via in‑app chat and to never share verification codes over the phone.

Context of Revolut’s crypto services

Revolut recently launched its euro‑backed EURR stablecoin in select European markets and is pursuing a conditional U.S. bank charter, though the breach is unrelated to these initiatives.