Revolut Disclosed Customer Data in Response to Fraudulent Request: Among It Was Bitcoin Transaction History

• Revolut fell victim to a sophisticated scheme.
• ZachXBT uncovered a leak of customer data, and the company confirmed it.
• Attackers gained access to documents and bitcoin transactions.

Fintech company Revolut has confirmed the disclosure of confidential data belonging to a limited number of customers after unknown actors used a legitimate government agency email domain to send fraudulent requests. The incident was reported by onchain investigator ZachXBT, who noted that the compromised information may have included copies of documents, bank statements, and a full transaction history, including bitcoin transfers. 

According to him, the attack may have targeted wealthy Revolut customers, and several affected users have already received official notifications from the company.

What Data May Have Ended Up in Attackers’ Hands

According to ZachXBT, Revolut failed to recognize the fraudulent request as a forgery because it came from a legitimate government agency domain. As a result, the request was fulfilled under the assumption that it originated from a real government body.

Among the data that may have been disclosed:

• Full name, date of birth, and occupation
• Home mailing address, email, and phone number
• Copies of a passport and/or driver’s license
• A selfie provided during verification
• Bank statements, including IBAN, account status, the date it was opened, and wallet number
• Withdrawal records
• Full transaction history, including bitcoin activity

At the same time, Revolut clarified that biometric data obtained during facial analysis was not compromised.

Revolut Took First Step Toward Banking License in US — Launch Is Planned for 2027

04.09.2026

Read now

ZachXBT called the incident a potentially targeted attack on high-net-worth customers. At the same time, he estimates that the total number of affected users is currently limited. Several Revolut users have already received warning emails about the incident.

Revolut Confirmed the Leak

The disclosure was confirmed by a Revolut spokesperson in a comment to TechCrunch. According to the spokesperson, the company uncovered a “sophisticated external impersonation fraud scheme” in which an unauthorized third party used an email address from a legitimate government domain to send fake requests.

“Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information,” the company spokesperson said.

Revolut said the incident affected a “limited” number of customers. The company contacted impacted users directly but did not disclose the exact number, nor did it say which country the incident occurred in or which government agency was spoofed by the attackers.

After detecting the fraud, Revolut blocked the relevant email address and notified the government agency, law enforcement, and the relevant regulators.

“Revolut systems and customer funds are unaffected,” the spokesperson added.

The incident comes as Revolut continues to scale its financial and crypto services. The company is preparing a secondary share sale with a potential valuation of around $115 billion, and is also building out its own digital asset products.

In parallel, Revolut is expanding its use of AI and crypto in its financial products. Previously, one of the company’s early investors, Max Karpis, said that around 80% of suspicious transaction reports in Lithuania come specifically from Revolut Bank.

In addition, Revolut introduced EURR — its first euro-denominated stablecoin. The asset complies with the EU’s Markets in Crypto-Assets (MiCA) regulation, and the company plans to expand its stablecoin lineup over time.

Сообщение Revolut Disclosed Customer Data in Response to Fraudulent Request: Among It Was Bitcoin Transaction History появились сначала на INCRYPTED.