Revolut disclosed customer passports and Bitcoin transaction records after staff replied to a fraudulent email disguised as an official government inquiry
Security & Exploits ·
The breach followed a social-engineering ploy in which attackers used a spoofed but authentic-looking agency domain to extract sensitive client files from Revolut employees
Revolut released identity documents, financial statements, and cryptocurrency activity logs to an account that was not actually authorized by any government body, according to a report from CryptoPotato. The request appeared credible because it came through the real domain associated with a government agency, even though the sender behind it had no legitimate authority to request the data. Staff at Revolut treated the message as a valid compliance or legal inquiry and handed over the requested files without further verification.
Coverage from Decrypt describes the same mechanism, noting that employees were misled into surrendering passports, account statements, and Bitcoin transaction histories tied to customer profiles. A separate summary from WuBlockchain adds that the exposed data included addresses and IBANs alongside identity documents and crypto transaction records, indicating the leak spanned both traditional banking details and on-chain activity tied to user accounts.
The scope of affected customers has not been confirmed. Reporting indicates the exposure is believed to be concentrated among high-net-worth clients, though Revolut has not specified how many accounts were involved. It also remains unclear whether login credentials or actual funds were compromised as part of the incident, as opposed to static personal and transactional records.
A post attributed to the account MagicalTux on X also circulated commentary on the incident, adding to the volume of independent discussion around the breach. Multiple outlets covering the story converge on the same root cause: a spoofed government email exploiting trust in an official domain rather than a technical intrusion into Revolut's systems.
What remains unresolved is the precise number of customers impacted, whether any funds were moved or accessed as a result of the disclosure, and what remediation steps, if any, Revolut has taken since the incident came to light. No official statement from Revolut confirming these details has been referenced in the available reporting.