Revolut says KYC and Bitcoin data may be leaked

Revolut said that some users 'sensitive information may be leaked, but systems and customer funds were not affected.

According to TechCrunch, financial technology giant Revolut revealed that after receiving fraudulent requests from legitimate government agencies for email domain names, some customers' sensitive information was disclosed to unauthorized third parties. This potential data breach may involve identity records, and according to secondary reports, it also contained bitcoin transaction data. Although the company insisted its systems and customer funds had not been affected, the incident attracted widespread attention.

This confirmation stems from Jagmeet Singh's original report on September 12, 2026. The report pointed out that this was a customer data disclosure incident caused by social engineering methods, not a breach of Revolut's internal infrastructure. A company spokesperson said that only a small number of customers were affected and Revolut had directly contacted these affected customers, but did not disclose the specific number of people affected.

The nature of the leaked data and the recipient

According to TechCrunch reports, Revolut confirmed that it received a fraudulent request originating from the mailbox domain name of a legitimate government agency before disclosing sensitive customer information to an unauthorized third party. The recipient is not a legitimate government agency and the requests are simply disguised as coming from the domain name.

Customer notifications reviewed by TechCrunch showed that the information exposed included identities and contact details, including dates of birth, postal and email addresses, phone numbers, and copies of passports or driver's licenses. Revolut's notice also stated that the data may also include verification selfies, account statements and transaction history, but the company emphasized that these categories are only "probable existence" for each affected user rather than conclusive confirmation.

Specific data types involved

From a macro perspective, the two main types of data involved are Know Your Customer (KYC) identity records and Bitcoin transaction data. The qualifier "possible leak" is crucial: Revolut's own notices distinguish the exposure of confirmed identity fields from conditional categories such as selfies and transaction history.

Decrypt reported that bitcoin-related details, including transaction history, wallet reference numbers, IBAN numbers and withdrawal records, had been disclosed, which the report attributed to customer notifications. Based on unconfirmed reports, no biometric facial telemetry data was involved;TechCrunch's report did not individually list Bitcoin, IBAN or wallet categories, so these should be considered single-source claims.

Revolut claims systems and funds were not affected

Revolut told TechCrunch: "Revolt systems and client funds were not affected." This statement is a self-assurance by the company and is not the result of an independent technical audit or forensic review.

Data exposure and fund security are two independent issues

Disclosure of customer records and security of customer balances are two different aspects of this incident. Ensuring that funds have not been moved does not prove that there has been no data exposure, nor does it eliminate the subsequent privacy and fraud risks to affected users caused by the disclosure of KYC documents and transaction records.

TechCrunch reported that Revolut had blocked the email address and notified relevant government agencies, law enforcement and regulatory agencies. However, the reports obtained did not identify the specific authorities, nor did they establish any enforcement actions, legal violations or regulatory determinations.

What is unclear about this potential data breach

Existing reports have not established several core facts. The company describes the affected population as a "limited number of customers," a qualitative description rather than a specific number.

• Scope and Timing: The exact number of customers affected, government agencies involved, geographical markets or exact event dates have not been disclosed. September 12, 2026 is the report date, not the verified leak date; according to TechCrunch, Revolut declined to confirm the institutions involved and did not answer whether the incident was limited to specific markets.
• Reason and response: The mechanism for how fraudulent requests bypass Revolut checks has not been independently verified. Decrypt reported that, according to unconfirmed information, the request was passed because it carried valid domain authentication credentials, but did not directly check the email header, forensic report or original notification. An open issue is the difference between verifying the authenticity of government email domain names and verifying whether the individual making the data request has legal authority. The reports obtained do not address this issue.

The lack of these details reflects what has not been publicly disclosed, rather than concealing evidence or corroboration of an ongoing investigation beyond what Revolut alleges is a notification.

How to interpret two types of data

KYC data

KYC data refers to identity and verification records collected by financial institutions under the anti- Money Laundering rules. The confirmed identification fields mentioned in the TechCrunch report-date of birth, address, phone number and copies of identification documents-make this exposure have a significant impact on impersonation and phishing risks, which is independent of any financial flow.

Bitcoin transaction data

As a type of data, Bitcoin transaction data describes activity records, not Bitcoin itself. If exposure of a transaction history or wallet reference number occurs, this is viewed separately from Revolut's claim that funds were not affected and does not individually imply exposure of private keys, wallet vouchers or account balances. With Revolut's launch of the euro-pegged stablecoin EURR and its conditional OCC approval of the National Bank charter, its crypto footprint has expanded, increasing the importance of its handling of regulated customer records.

Impact over the next six months

For holders and traders, the actionable risk is targeted fraud based on leaked KYC documents rather than a threat to on-chain balances. According to TechCrunch quoted online investigator ZachXBT as saying that the incident reportedly targeted high-net-worth users, but this has not been confirmed by the company. Given the higher risk of phishing such users, if verified, it deserves close attention.

For policy observers, the next specific triggers include whether Revolut or a designated regulatory agency will issue event-specific disclosures, whether the number of affected customers will occur, and whether the institutions involved will be identified. As of September 13, 2026, Bitcoin itself has not shown a market reaction related to the incident, which is consistent with off-chain record disclosures that do not involve settlement or custody.

FAQs: Possible KYC and Bitcoin transaction data breach in Revolut

Has Revolt data breach been confirmed?

Revolut confirmed to TechCrunch that it disclosed sensitive customer information to unauthorized third parties after receiving fraudulent requests from government domain names. Certain categories, such as verified selfies and transaction history, are characterized as "possibly present" rather than "confirmed" for each user.

What data might have been leaked?

Confirmed identity fields include date of birth, address, phone number, and a copy of identification documents. A wider range of KYC records and Bitcoin transaction data may also be involved; bitcoin-specific categories are based on Decrypt's single source reporting.

Have Revolut's systems and funding been affected?

Revolut said its systems and client funds were not affected. This is a statement from the company and not the result of an independent audit.

How many users may be affected?

Revolut described the impact as a limited number of customers and has contacted them directly. Specific numbers or geographical ranges have not been disclosed.

Disclaimer : This article is for reference only and does not constitute financial or investment advice. There are significant risks in the cryptocurrency and digital asset markets. Before making a decision, be sure to study it yourself.