Bitcoin · Decrypt
Revolut Leaks Passports, Bitcoin Transaction Histories to Fake Government Request
Compiled by KHAO Editorial — aggregated from 3 sources. See llms.txt for citation guidance.
✓ KHAO Verified
Fintech giant Revolut handed sensitive customer data, including passport copies and full Bitcoin transaction histories, to a malicious actor after falling for a fraudulent request disguised as a legitimate government inquiry.
Key facts
- Revolut, which launched its euro-pegged EURR stablecoin this year, is currently weighing an IPO
- Most alarming for crypto holders, the financial data included account statements with IBAN and wallet reference numbers, withdrawal records and full transaction history, including Bitcoin
- Sharp reminder that KYC hasn’t produced meaningful upside and has put many in harm’s way. pic.twitter.com/RimOBQr7DW
- Because the message carried valid domain authentication credentials, Revolut fulfilled it in the belief it was genuine
Summary
Revolut disclosed sensitive customer data—including passport copies, verification selfies and full Bitcoin transaction histories—after fulfilling a fraudulent request sent from a government agency's legitimate email domain. A Revolut spokesperson confirmed it was "a sophisticated external impersonation scam," said a "limited" number of customers were affected, and stated systems and funds were unaffected, but declined to give numbers or name the agency. ZachXBT said the breach appeared to target high-net-worth users, raising "wrench attack" concerns amid a wave of similar leaks. According to a customer notification circulated by crypto investigator ZachXBT, Revolut received a request for customer information that appeared to come from a government agency, sent from an unauthorized email account using the agency's official domain.