Revolut Data Breach: Am I Affected? What will happen to my Bitcoin history?

If you have a Revolut account, how to determine whether the data event from September 11 to 12, 2026 affected you?

If you have a Revolut account and want to know whether the data incidents of September 11 and 12, 2026 have affected you, there are only two reliable ways: one is a notice sent by the company to affected customers, and the other is a self-initiated personal data access request in accordance with Article 15 of the General Data Protection Regulation (GDPR). Everything else is speculation. Failure to receive a message does not mean safety; it simply means that no notification was received.

This case is different from leaks that usually dominate the industry's headlines. The server was not compromised, no malware was implanted, and the password was not cracked. An unauthorized party requested customer data from Revolut through a real, properly authenticated government agency email domain name. Revolut regarded it as a legal request and handed over the relevant documents. This situation is particularly embarrassing for Bitcoin holders, as the released material includes a complete transaction history.

What Revolut handed over, and what content the company said was not affected

According to CoinDesk reported on September 12, 2026 (Citing notices sent to those affected), the categories of data leaked include passports and driver's licenses, identity verification selfies, names, date of birth, occupation, home address, email address, phone number, IBAN account numbers, account statements, withdrawal logs and a complete transaction history that includes all Bitcoin activity.

Revolut told BeInCrypto that they had discovered a complex external identity attack in which an unauthorized third party submitted a fraudulent information request through the email domain name of a legitimate government agency; systems and customer funds were not affected. According to the company, police, data protection agencies and financial regulators have stepped in and relevant agencies have been told there is an unauthorized account operating within its domain name. Because the investigation is still ongoing, Revolut did not disclose which agency. The number of people affected has also not yet been determined; the company said the number was limited, while zachXBT, the investigator who disclosed the incident, described the target as "a small circle of wealthy users."

What is clearly not disclosed in the notice includes: credentials, passwords and biometric templates behind facial recognition. This distinction is important because it determines which protections are effective. An attacker never had your password, so changing a new password will not stop him.

How to tell if you are a customer of Revolut who received a notification

Revolut stated that it had written separately to notify affected customers; the customer report stated that the messages were dated September 11, 2026. There is no public list, and for good reasons it will not exist. Therefore, the responsibility for inspection lies with you.

Revolut's notifications and how to distinguish them from phishing emails

Notifications issued under Article 34 GDPR are communications sent by a company to affected individuals who inform it of the risk of personal data disclosure. It describes the circumstances of the incident, the types of data involved, and the recommended actions. How to identify such notifications: These messages do not require you to enter credentials via a link, approve payments, or connect to your wallet using a recovery phrase.

This is the beginning of the second wave of attacks. Such leaks generate forged messages within days, disguised as a company reply, and this time the attacker has names, home addresses, IBAN and account dynamics. This makes the forgery extremely credible. Please check every incoming message within the Revolut app, rather than via links in emails, and follow the rules we set out in our guide to checking real senders 'domain names.

Article 15 Personal Data Access Request as Written Proof

Article 15 of the GDPR gives you the right to ask a company to explain what personal data about you it processes and to which recipients it has disclosed it. What's important here is the second part: Request to force the company to declare whether your documents fall within the scope of disclosure. The period is one month and can be extended for two months in complex circumstances. If the extension is extended, the company must inform you.

Make a written request, stating the event and its date, clearly asking the recipient of your data, and requesting a copy (if notice was sent to you). Reserve your reply. Anyone wishing to file a lawsuit or complaint in the future needs these communications records as a basis.

Why Bitcoin transaction history is the most dangerous part of the data set

ID documents can be replaced, IBAN can be changed, and home address can also be changed. In contrast, Bitcoin history points to a public database that cannot be revoked. Whoever knows your deposits and withdrawals from a provider knows the amount, the timestamp, and in many cases the counterparties on the chain.

Clustering analysis from statement to your Bitcoin addresses

Clustering analysis is a technique that assigns multiple Bitcoin addresses to a single economic entity based on shared characteristics (e.g., they appear as inputs in the same transaction). As long as no one knows who the cluster belongs to, it remains an anonymous set of addresses. Withdrawal logs with amounts and timestamps provide missing anchors, and from that moment on, the cluster carries names and home addresses.

What followed was disturbing calculations. Not only can an attacker see that you have bitcoins, but they can also estimate from the associated addresses how much of them still exists and whether they are moving. When we reported on events in France, we described what this combination of identity, home address and traceable wealth might lead to: This is where cryptocurrency-related kidnappings and extortion often start.

Requests come in through real doors: not domain names, but internal accounts, are forged

Emergency data requests: The mechanism behind fake government inquiries

An emergency data request is a request for law enforcement information that a company responds to on imminent risk grounds without a court order and does not apply to normal supervisory procedures. This program exists because in some cases hours are crucial. It has also been a known entry point for years, as the only inspections are judgments made by employees facing urgent inquiries that appear to be official.

This sequence is documented in detail in professional literature: someone gains access to an official mailbox or creates an account within the agency's domain name, writes an emergency information request from there, and receives data because the recipient is trained to quickly serve public authorities. This is exactly the pattern Revolut described in its statement when referring to "unauthorized accounts within an institution's domain name."

Why checking the sender's domain name, SPF, and DMARC is invalid here

SPF, DKIM, and DMARC are technical procedures that allow the recipient of an email to confirm that the message was indeed sent from the domain name in question and that it was not tampered with during transmission. These programs answer only one question: Does the message actually come from this domain name? As for whether the person behind the mailbox has access to it, they have no idea.

This is a negative test of the recommendations we issued ourselves. Checking the sender's domain name is still correct and can catch the vast majority of attacks. It only stops working when the attacker controls an account within the real domain name, because at this time all technical checks pass, but in fact everything is wrong. Anyone who relies solely on the signal will mistake a passed certification for a passed authorization check.

Functions and limitations of changing passwords after this data breach

The general recommendations after the breach are: change passwords, enable two-factor authentication, and check equipment. Here, there is only half of the right, and the wrong half is more important. According to the notice, what left the company was not the voucher, but the identification documents and account history. The new password will not deprive the attacker of anything because he never had the old password.

What really helps is the measures against subsequent attacks. This includes requiring a hard confirmation of withdrawals in the app, rejecting so-called employee phone inquiries in principle and hanging up, and assuming that any call that quotes your real account details may be the result of this incident. The caller who knows about the last transfer you made is no longer a proof of the authenticity of the call.

Immediate measures: Identity abuse, account security, cryptographic assets

Measures fall into two categories. One category concerns your identity, which makes sense whether it involves cryptocurrency or not. The other category concerns your positions and where they should be kept in the future.

ID data cannot be recalled

The leaked scanned copy of the ID card still exists in the outside world. All that's left is observation: Check your credit files regularly, review inquiries and contracts you don't recognize, and ask your bank to explain its rules for opening accounts and changing addresses. If there is suspicion of identity abuse, the police should be reported to the police, because it is later determined that the time of the abuse occurred determines the issue of liability. German financial regulators have warned about this pattern; we have analyzed in detail BaFin's warnings about identity abuse in the cryptocurrency industry.

Home address plus Bitcoin holdings: Taking physical risks seriously

The most unpleasant part of this combination lies outside the digital world. Anyone holding his home address, ID photo and wealth proof has everything he needs for a door-to-door attack. In practice, this means that cryptocurrency holdings are not publicly mentioned on social media, hardware accessories are not delivered to home addresses, and specific amounts are not mentioned in conversations with acquaintances. People who keep large amounts of money on their own can find devices in our hardware wallet comparisons that allow access lockouts with extra passphrases so that the entire balance will not be released if access is coerced.

This caution is not a panic response. It is consistent with what victims of early leaks in the industry later described, and can be done by changing habits.

Anyone who wants to complain needs to have documentation first: obtain disclosure information and then contact the regulatory authority

Where can German Revolut customers complain to

German customers usually have a contractual relationship with Revolut Bank UAB in Lithuania, which is licensed as a credit institution by the Central Bank of Lithuania and the European Central Bank; at the same time, the company has branches in Germany. For data protection, the provider's own privacy statement lists the Lithuania Data Protection Authority as the lead regulatory authority. Please check the details in your own contract documents, as the responsible entity may vary depending on the product and contract date.

This sequence makes sense: first, the company makes an Article 15 request, and then, after receiving a response or after the deadline, the data protection authority complains. The right to complain to the data protection authority of your place of residence remains in place under the General Data Protection Regulation; in cross-border cases, it will refer the matter to the lead authority. Without prior correspondence, complaints lack a basis.

How to reorganize your crypto position after a data breach

A provider data incident is a good time to review position splits without rushing. The decisive question is not which provider is considered the safest. A more useful way to think about how much wealth any single provider needs to store. Trading accounts only require the actual transaction amount. Going beyond that part is a decision that is equally likely to be reversed.

Self-hosting means holding private keys yourself rather than delegating them to the provider. This transfers the risk, not eliminates it: Anyone who self-administers bears the sole risk of loss and needs a recovery phrase backup plan that can withstand house fires and relocation. For many investors, splitting is a sensible middle ground, with a small portion left at the provider ready for trading and the rest transferred to self-custody.

The order here is important: make a backup plan first, and then act. Anyone who transfers balances in the excitement of bad news will make the most expensive mistake of the year that week.

Case shows KYC data on cryptocurrency providers and new banks

KYC stands for "know your customer" and refers to the legal identity checks that banks and cryptocurrency service providers must perform before opening accounts. The check is non-negotiable and at each regulated provider, it creates a record of ID photos, selfies, addresses and account activity. Revolut's case shows that the attack surface of this record consists not only of the server, but also of the programs the company uses to answer information queries.

This raises a practical question about selecting providers: how does the company handle official information inquiries, whether it publishes relevant data, and how quickly will it notify affected people? Anyone looking for a new trading platform can refer to our introduction of regulated cryptocurrency exchanges to find providers that are licensed under the European supervisory framework. A license is not a promise to prevent such attacks, but a guarantee that regulatory bodies are responsible and reporting obligations apply.

The incident joins a chain that has hit European cryptocurrency investors many times this year. The article types are always the same because the problems are the same; our writing about the Trezor data breach and how to check if you are affected gradually shifts to this case.

FAQs about Revolut data breaches

Is my money in Revolut at risk now?

According to the company, systems and customer funds were not affected by the incident and there were no available sources to contradict this. The incident was the release of files to unauthorized parties, not access to accounts. The risk lies in what you try to do with those documents afterwards.

Do I have to change my Bitcoin address?

Changing the address has no effect on the history that has been disclosed because it was stored immutable on the chain in the past. For future incoming payments, it will still be wise to use a new address and permanently retain the balance at an address directly linked to withdrawal from the provider account.

So what about the millions of Revolut records during the summer?

That's another matter. Regarding the claim that the large-scale dataset appeared on the dark web in July 2026, there is no document showing that it was related to information inquiries in September. Mixing the two is misleading because of the different types of data and attack routes involved.

How do I know that the email really comes from Revolut?

No, not just email. Open the application and check to see if the same information is in your inbox. In this case, this rule is more important than before, because passed domain name certification does not prove authorization.

Revolut Data Breach: Summary of Key Points

Determine if you are affected and don't estimate.

Check in the Revolut app for waiting notices and independently submit a personal data access request in accordance with Article 15 GDPR, clearly asking the recipient of your data. Anyone who wishes to change providers later can narrow down the list of candidates with an overview of regulated cryptocurrency exchanges.

Decouple your positions from your identity record.

Decide how much amount must be left with the provider to prepare for the transaction, and transfer the rest to self-custody and a backup plan in place before moving. Device options, including passphrase functionality, can be found in Hardware Wallet Comparison.

Plan for the second wave of attacks.

Expect calls and messages in the next few weeks that know your real account details and treat every contact as unconfirmed until you see what's in the app. If you need to find a software solution for the part you need to leave with the provider to prepare for the transaction, a software wallet is more helpful.

(As of September 12, 2026. This article does not constitute investment advice. Price and fee structures are subject to change; please check terms with your provider before purchasing.)

Source: CoinDesk's statement on the types of data involved and Revolut's statement on BeInCrypto.