Revolut warned customers on September 11 that a sophisticated impersonation scam had exposed their personal data. An unauthorized party used an email account within a legitimate government agency’s domain to request customer information. The message appeared genuine because it carried genuine domain authentication credentials, but it was not.
The breach became public that night after Mark Karpelès and blockchain investigator ZachXBT shared the warning emails on Telegram. The exposed data reportedly included names, addresses, identity documents, KYC selfies, bank statements, and transaction histories.
On September 13, attackers began releasing files and threatening daily leaks. A reported ransom demand of 10,000 BTC, worth about $780 million, followed. Revolut has not confirmed the demand or verified the leaked files.
The community has been vocal about how it feels
In a recent tweet by a cybersecurity reporting outlet, the threat actors who targeted Revolut with information-demand emails are now posting sensitive customer data, including that of high-profile clients such as tennis player Shevchenko and Römer, CEO of Gamdom/Skinscom. This has drawn massive attention and market reaction.
‼️ BREAKING: The threat actors who targeted Revolut with information-demand emails are now posting sensitive customer data, including that of high-profile clients such as tennis player Shevchenko and Römer, CEO of Gamdom/Skinscom.
They want Revolut to pay up. They say they’ll… pic.twitter.com/obuVOOABx7
— International Cyber Digest (@IntCyberDigest) September 13, 2026
Most of the reaction following this tweet has been about the data, not the attack. zkPassport says the problem starts at collection. Firms store identity data because states can demand it. Attackers then abuse that same process.
The Revolut situation exposes a much bigger problem with how KYC works today.
Companies collect and retain huge amounts of sensitive identity data which govts can request access to….Here, attackers reportedly exploited exactly that process.
ZK can be part of the solution. https://t.co/qOjxoSMeZe
— ZKPassport (@ZKPassport) September 14, 2026
Helius CEO Mert was blunter. He said leaks like this end in home invasions, and that ZK-based KYC should be the only legal form.
One X user, Mayabayaa, said handing over customer data should carry real consequences. If not, firms will keep assuming they can ride out the fallout.
giving away customer data just like that is a crime and we should really do something about it
if we don’t do something, these companies will think they can always get away with this https://t.co/A8H288VrMc
— mayabayaa (@mayabayaaa) September 14, 2026
Another user, Vweeter, tied the failure to ambition, arguing that Revolut’s push to become a bank is what created a file worth stealing in the first place.
ALSO READ: Crypto Security Has Come a Long Way, So Have the People Trying to Break It
The same data security problem has hit crypto before
Although Revolut is a fintech that operates regulated crypto businesses and offers crypto trading and custody, it is not primarily a crypto firm. Core crypto firms are not entirely new to this kind of situation. Binance faced the same demand in August 2019 when someone claimed to hold 10,000 KYC photos of customer accounts from the exchange and demanded 300 BTC. When the exchange refused to pay, the attacker pushed hundreds of passport photos into a Telegram group instead.
Coinbase recorded a similar incident in May 2025. Criminals bribed outsourced support agents and took records for about 70,000 users from the exchange. Then they demanded about $20 million, which the exchange refused to pay.
Cyber criminals bribed and recruited rogue overseas support agents to pull personal data on <1% of Coinbase MTUs. No passwords, private keys, or funds were exposed. Prime accounts are untouched. We will reimburse impacted customers. More here: https://t.co/SidVn59JCV
— Coinbase 🛡️ (@coinbase) May 15, 2025
However, this is not the first time Revolut has had an issue with cybercriminals. Their 2022 breach hit 50,150 customers and caused a Lithuanian probe. In February 2026, the firm reported a former employee to police over an alleged ransom threat tied to KYC data. But one thing many have observed in these attacks is how the attackers didn’t need to exploit a software vulnerability in Revolut’s systems. The data came out through vendors, staff, support desks, and now a legal-request inbox.
What to watch next
People are waiting to see whether Revolut or the government agency involved would name the mailbox that was used for this attack. Mark Karpelès has argued they should, so other banks and exchanges can search their own request logs for the same sender. Secondly, whether watchdogs open formal probes or accept this as a scam the bank could not have stopped.
Finally, whether firms change how they check requests. The options are out-of-band callbacks, shared verification networks for police requests, or zero-knowledge proofs that leave no document to steal. Making payments to these cybercriminals is unlikely to stop the attacks. Binance and Coinbase both refused to pay, and the data came out anyway.
FAQs
Was Revolut hacked?
No. Revolut says its internal systems were not breached and no funds were touched. A fraudster used an email address on a legitimate government domain to make fraudulent requests for customer records through Revolut’s legal compliance channel, and the requested data was handed over.
What data was exposed?
The exposed information includes names, birth dates, occupations, email addresses, phone numbers, and physical addresses. It also included identity verification files like passport and driving licence scans, KYC selfies, IBANs, account statements, withdrawal records, and full transaction histories.
How do I know if I am affected?
Revolut sent email notifications directly to the affected customers on September 11 and 12, 2026. If you did not receive an official email notice from Revolut regarding this incident, your data was not part of the exposed subset.
Is my money at risk?
Your account balance and funds remain safe on Revolut. However, affected users face an elevated risk of targeted phishing, account takeover attempts on other platforms, and physical targeting because attackers hold genuine ID scans, full transaction records, and personal details.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
