Revolut exposed customer data, bitcoin activity after fake government request
Fake government request tricked Revolut into handing over customer data
Digital bank Revolut handed over customer data, including passports and bitcoin transaction histories, after a fake government request passed its security checks this week, according to CoinDesk.
The request appeared to come from a legitimate government agency and carried credentials that passed Revolut's checks. The bank discovered the request was fraudulent only after separately contacting the agency, according to notices sent to affected users.
Key facts from the report
- Exposed files reportedly included passports or driving licences, verification selfies, names, dates of birth, occupations, home addresses, emails, phone numbers, IBANs, account statements, withdrawal records and full transaction histories, including all bitcoin activity.
- Revolut has not disclosed how many customers were affected.
- Onchain investigator ZachXBT said the breach appeared limited in size and may have targeted high-net-worth users.
How the breach happened
The weak point was authorization, CoinDesk reports. Once the request cleared Revolut's internal checks, someone posing as a government official gained access to the deeply personal information the bank had collected to meet identity and compliance requirements.
What Revolut has said
Revolut said in an email that customer funds remained safe. It said it has notified affected users and regulators and blocked the source of the request. The company did not immediately respond to CoinDesk's request for comment.
Investigator's assessment
Onchain investigator ZachXBT, who drew attention to the incident, said in a Telegram broadcast that the breach appeared limited in size and may have targeted high-net-worth users. This is his assessment, not a confirmed statement from Revolut.
Affected customer count still unknown
Revolut has not said how many customers were affected. It has also not confirmed whether the breach targeted specific groups of users.
Why the incident raises privacy concerns
Bitcoin's blockchain records transactions publicly, while personal details such as a passport or home address sit outside the network. Financial intermediaries can connect these two sets of information, linking a real person to their onchain activity, which malicious actors may use to target large bitcoin holders.
The case also highlights how AI makes convincing emails, documents and identities cheaper to produce at scale, and it strengthens the case for privacy tools such as zero-knowledge proofs, which can allow a person to prove an identity check was completed while revealing less personal information.
