Revolut confirmed it disclosed sensitive customer data — including passport and ID scans, verification selfies, contact details and complete Bitcoin transaction histories — after falling for a fraudulent data request sent from an email account that impersonated a government agency. The incident, disclosed around September 12, 2026, underscores a growing risk in the crypto industry: the very identity-verification systems designed to prevent fraud can become a single point of failure that exposes users to real-world harm.
A spoofed request from a trusted domain
According to Revolut, the request came from what appeared to be a legitimate government domain, making it look authentic enough to pass internal checks. The fintech told TechCrunch this was a sophisticated impersonation scam rather than a technical hack of its systems. Revolut said it has since blocked the sender, alerted the impersonated agency, notified law enforcement and informed relevant regulators. The company maintains that its core systems and customer funds were not compromised — only that data was handed over to parties who should never have received it.
Revolut has declined to name the agency that was impersonated or to disclose how many customers were affected, describing the number only as “limited.” The categories of data involved, however, are extensive: full names, dates of birth, occupations, home addresses, emails, phone numbers, copies of passports or driver’s licenses, verification selfies, IBAN details, wallet reference numbers, withdrawal records and full transaction histories. Together, this is close to a complete financial and identity profile of each affected customer.
Crypto investigator ZachXBT flagged the leak, noting it appeared to specifically target high-net-worth users — the accounts most likely to hold large crypto balances and, therefore, the most attractive targets for follow-up fraud or physical crime. This is not a hypothetical concern in the industry: crypto holders whose identities and balances are exposed have increasingly become targets of so-called “wrench attacks,” in which criminals use leaked personal data to locate and coerce victims into handing over their holdings. Our earlier coverage detailed how Revolut was tricked into leaking customer data via a fake regulator request, and companion reporting examined how Revolut sent customer data to fraudsters posing as a regulator.
Why KYC data has become a liability
Financial platforms that offer crypto services are required under know-your-customer (KYC) rules to collect and retain exactly the kind of data that leaked here: government ID, proof of address, biometric selfies and transaction records. This is a regulatory obligation, not a choice — but it also means that fintechs sit on large, centralized troves of exactly the information that criminals want most when targeting crypto holders.
The Revolut case is not isolated. It follows other recent data-security incidents touching the crypto sector, including a breach at hardware wallet maker Trezor and a separate incident at X. Taken together, these episodes point to a pattern: as crypto adoption grows and more mainstream financial platforms integrate digital-asset services, the attack surface expands well beyond exchanges and wallets to include the customer-service and compliance infrastructure surrounding them. A single successful social-engineering attempt — not a breach of blockchain security, but of an email inbox — can expose the same category of sensitive data that would otherwise require breaking cryptographic protections.
For Revolut specifically, the timing adds weight to the story. The company launched its EURR stablecoin this year and is reportedly weighing an initial public offering, both signs of a firm pushing deeper into regulated financial infrastructure and inviting closer scrutiny of its security practices as it does so. Other payment platforms are moving in similar directions: Nubank recently expanded its stablecoin-powered global account beyond Latin America, and MoneyGram introduced a stablecoin-backed Visa card in Colombia. As more mainstream fintechs layer crypto products onto traditional banking rails, incidents like Revolut’s raise the stakes for how carefully they must handle the identity data that regulation requires them to hold.
What to watch next
- Whether regulators that were notified open a formal inquiry into Revolut’s data-handling and verification procedures for third-party requests.
- Whether Revolut, under pressure from customers or regulators, eventually discloses the number of affected users or the identity of the impersonated agency.
- Whether affected high-net-worth customers report follow-up scams, extortion attempts or physical security incidents linked to the leaked data.
- Whether other fintechs offering crypto services tighten internal protocols for verifying law-enforcement or regulatory data requests, given the pattern of social-engineering attacks across the sector.
The episode is a reminder that crypto security is no longer just about protecting private keys or exchange hot wallets. It also depends on the administrative and compliance layer of the financial institutions that now sit between everyday users and their digital assets — a layer that, as this case shows, can be manipulated with nothing more sophisticated than a convincing email.
Source: Decrypt
This content is for informational purposes only and does not constitute financial or investment advice.
Create a free account to comment and earn rewards.
Create account Log in