Revolut confirms data breach after fraudulent email leaks Bitcoin user information

Revolut confirms a data breach in which Bitcoin user details were exposed through fraudulent emails.

Financial technology giant Revolut has confirmed a security breach that resulted in the disclosure of sensitive customer data, including passport copies and complete Bitcoin transaction history. The leak came after the company responded to a fraudulent request disguised as a legitimate government investigation.

Impersonation leads to major data breach

A spokesman for Revolut said the breach was caused by a "carefully planned external impersonation scam." The attacker submitted the request via email sent from the domain name of an official government agency and successfully passed the company's verification check.

Revolut reported that only a small number of customers were affected. The company said it had blocked hacked email addresses, notified relevant government agencies, law enforcement and regulatory agencies, and took steps to strengthen its systems. According to Revolut, the incident did not affect any customer funds or internal systems.

Revolut described the incident as a highly complex impersonation scheme that utilized real government agency domain names and emphasized that its internal systems and customer funds remained secure.

Although the existence of the vulnerability was confirmed, Revolut did not disclose the exact number of customers affected or the identity of the institution being impersonated. The attack has raised concerns among customers and cryptocurrency security analysts about the potential risks posed by compliance-based identification processes in the industry.

Data exposure contains Bitcoin account history

The range of leaked information is wide. Notification letters shared by cryptocurrency investigator ZachXBT for affected customers showed that contact details ranging from full names, date of birth and occupation to addresses, emails and phone numbers were leaked. Documents include a copy of your passport or driver's license and a verified selfie photo of the customer.

As part of the leak, financial data included account statements with IBAN (International Bank Account Numbers) and wallet reference numbers, withdrawal records and detailed transaction history, notably including Bitcoin activity. However, Revolut said biometric facial telemetry data was not within the scope of the leak.

The leaked financial details covered users 'cryptocurrency wallets, complete Bitcoin transactions and related supporting documents, raising serious security concerns among those involved.

ZachXBT, a well-known investigator in the cryptocurrency field, pointed out that the leak appeared to target high-net-worth users. He noted that the incident has heightened concerns about "wrench attacks," a type of physical coercion attack designed to force individuals to hand over assets. The broader community has criticized current know-your-customer (KYC) practices, with some arguing that such regulations increase risk but fail to provide real safety benefits to customers.

Small Dictionary: Wrench attack -A type of physical attack in which criminals use threats or force to force individuals to provide access to their cryptocurrency or digital assets, usually after learning their identity and positions from leaked data.

The industry faces increasing security pressure

Revolut's vulnerability occurred against a backdrop of rigorous scrutiny of data security in the cryptocurrency industry. Trezor, a hardware wallet provider that focuses on the secure storage of digital assets, recently expanded the scope of a support vendor vulnerability that affected the records of tens of thousands of customers. Social media platform X also reported an incident that led to a large number of unexpected password resets among users.

Originally launched as an online banking app, Revolut now offers a broad suite of financial services, including cryptocurrencies and the recently launched EURR stablecoin, and is currently considering an initial public offering (IPO).

The company assured the public that the scope of impact was under control, but did not provide a timeline for the conclusion of the investigation.