Revolut told a group of customers that their passports, home addresses and full Bitcoin (btc) transaction histories reached an unauthorized third party after a forged government request cleared its checks.
Key Points:
- Revolut disclosed customer identity documents and Bitcoin transaction histories after treating a fraudulent government request as genuine.
- The company says funds are safe and regulators have been notified, but it has not named the impersonated agency or published a customer count.
- Investigators say the disclosure looks limited in size and aimed at high net worth account holders.
Revolut Notice Details Bitcoin Exposure
The bank emailed affected users late on Sept. 11, and on-chain investigator ZachXBT flagged the notice on his Telegram channel hours later. The message said the demand came from an unauthorized account created inside an official government authority's own domain, carrying genuine domain authentication credentials. Revolut acted on it under what it called a reasonable belief that the request was authentic.
The disclosed records covered full names, dates of birth, occupations, home addresses, email addresses, phone numbers, passport or driving licence copies and the selfie taken at onboarding.
Account statements with IBANs, opening dates and wallet reference numbers went out too, alongside withdrawal records and complete transaction histories that included Bitcoin.
Revolut later contacted the agency to verify the demand, and in doing so alerted the authority that an unauthorized account was sitting on its own domain. It said customer funds remain safe and no passwords were taken. Regulators have been told, though the company has not said how many people were affected.
Also Read: Ethereum Faces $2,800 Supply Wall After ETF Inflows Jump To $216M
ZachXBT And Karpelès Press Revolut
ZachXBT called the incident likely limited in size and said it appeared aimed at high net worth users. He later published screenshots showing that both of Revolut's accounts on X had blocked him, after he checked whether the firm had posted anything publicly.
Mark Karpelès, the former chief executive of Mt. Gox, said he received the warning under the subject line "Urgent security update about your Revolut account" and posted long excerpts from it.
He argued that Revolut or the impersonated authority should name the agency publicly, so other banks and exchanges can search their own legal request logs for the same mailbox. A Revolut support account replied that the firm takes privacy seriously.
Bitcoin Records Deepen Targeting Risk
Public blockchains show where coins move, but they carry no passport scan, no occupation and no street address. Pairing a verified identity with a complete transaction history turns a routine compliance file into a map of who holds what, and where they sleep at night.
Revolut has run into data trouble before. Lithuania's data protection regulator recorded 50,150 Revolut customers affected by a social engineering attack on staff back in September 2022. The firm also disputed a July 2026 forum listing that claimed 75 million of its records were for sale, telling researchers the set was probably fabricated.
Read Next: Nvidia's Jensen Huang Says Security Vendors Benefit From AI Threat Panic
