Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Revolut falsified government requests to leak customer data, raising concerns about the privacy and security of high-net-worth users.
Financial technology company Revolut informed some customers that their passports, home addresses and complete Bitcoin (BTC) transaction history were obtained by illegal third parties after a forged government request passed an internal review.
Core Points of the Event
1. Identity and transaction data breach: Revolut disclosed customer ID and Bitcoin transaction records after the company mistook a fraudulent government request for authenticity.
2. Fund Security and Regulatory Notice: The company stated that its customers 'funds are safe and have reported to the regulatory authorities. But as of now, Revolut has not disclosed the name of the institution being impersonated or the specific number of customers affected.
3. Targeting high-net-worth people: Investigators pointed out that the scope of the data breach appears to be limited and mainly targets high-net-worth account holders.
Revolut Notice Details: Bitcoin Exposure
The bank sent an email to affected users on the evening of September 11. Within hours, online investigation expert ZachXBT flagged and analyzed the matter on its Telegram channel.
The content of the email shows that the illegal request comes from an account disguised as the domain name of an official government agency and carries a real domain name authentication certificate. Revolut performed this operation based on the principle of "reasonable belief that the request is authentic."
A wide range of leaked records include:
- Full name, date of birth, occupation, home address
- Email Address, Telephone Number
- Copy of passport or driver's license
- Facial selfie taken when opening an account
- Contains IBAN's account statement, account opening date and wallet reference number
- Withdrawal records and complete transaction history (covering Bitcoin transactions)
Revolut then contacted the relevant agency to verify the authenticity of the request, which also alerted the agency to the issue of unauthorized accounts under its domain name. The company emphasized that customer funds remain safe and no passwords have been stolen. Although regulators have been informed of the incident, the company has not released the exact number of people affected.
ZachXBT and Karpelès pressured Revolut
ZachXBT said the impact of the incident may be limited and appears to be targeted specifically at high-net-worth users. Later, he posted a screenshot showing that after he checked whether Revolut had publicly issued a statement on the X (formerly Twitter) platform, both of his official accounts blocked it.
Former Mt. Gox CEO Mark Karpelès said he received a warning email with the subject line "Emergency security updates about your Revolut account" and made public a long excerpt. He believes that Revolut or the impersonated institution should disclose the name of the institution involved so that other banks and exchanges can search their legal request logs to see if there are requests sent to the same mailbox. A Revolut support account replied that the company attaches great importance to privacy protection.
Bitcoin records deepen targeted tracking risks
Although public blockchain can show the flow of money, it does not contain scanned passports, professional information or street addresses. Combining verified identities with a complete transaction history turns what was originally routine compliance documents into detailed maps that reveal "who holds what assets" and "where they live at night."
Revolut has also been involved in data disputes before. Lithuania's data protection regulator has recorded a social engineering attack on employees in September 2022, affecting 50,150 Revolut customers. In addition, the company denied a July 2026 forum message claiming 75 million of its records were for sale, informing researchers that the dataset might be fake.
