Revolut exposes customer passports and Bitcoin transactions in fake government request breach
Revolut handed over customers' personal data to fraudsters after receiving a fake request impersonating a government agency. The information exposed included identity documents, home addresses, and full transaction histories, including Bitcoin activity.
According to CoinDesk, the request contained credentials that passed Revolut's internal checks, leading the company to initially treat it as legitimate. The fraud was discovered only after the bank separately contacted the government agency.
Revolut did not disclose how many customers were affected. The company said customer funds remained safe, blocked the source of the request, and notified affected users and regulators.
Fraudsters obtained documents and transaction histories
The information handed over may have included passports or driving licenses, verification selfies, names, dates of birth, and customers' occupations. Home and email addresses, phone numbers, and IBANs were also exposed.
The fraudsters also obtained bank statements, withdrawal records, and full transaction histories for some users. These included Bitcoin transactions.
The weak point was the request authorization process. After passing Revolut's internal checks, a person posing as a government official was able to access data the company collects for customer identification and regulatory compliance purposes.
On-chain researcher ZachXBT, who drew attention to the incident, said the breach was likely limited in scope. According to him, wealthy users may have been specifically targeted.
Combining personal data with publicly available blockchain information creates a particular risk. Bitcoin transaction history is publicly visible on-chain, while information held by a financial intermediary can link a specific person, their address, and other personal details to their on-chain activity.
Data breaches increase risks for crypto holders
The incident comes as AI tools make it easier to create convincing emails, documents, and fraudulent requests. At the same time, financial companies hold large amounts of information about their customers' identities and the movement of their funds.
Hardware crypto wallet maker Ledger previously faced a class-action lawsuit seeking at least $500 million over customer data breaches. The plaintiff alleges that the company failed to adequately protect users' personal information and did not take sufficient measures following earlier incidents.
The lawsuit renewed attention on the risks associated with storing personal information belonging to crypto service users. Such data can pose an additional threat if it allows someone's identity to be linked to their digital assets.
Earlier, we reported that Revolut reduced premium subscribers' access to WeWork workspaces after the cost of the service increased. The changes affected one of the additional benefits offered under the company's paid plans.
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
