BTC Security Current Affairs

Revolut Fumbled a Fake Government Email and Leaked Customer Passports, Bitcoin Histories

2026-09-13

Revolut confirmed on Saturday it handed over sensitive customer data to an unauthorized third party after falling for a fraudulent email from a spoofed government domain. The request passed all their authentication checks. Which is not great when you're holding onto the financial records and identity documents of 80 million people across more than 30 countries.

The fraudulent email address had valid domain authentication credentials—SPF, DKIM, DMARC, the works. All the standard email security protocols. Revolut saw the official government agency domain and fulfilled the data request without bothering to verify it through any other channel. Only later did they realize someone had impersonated a government agency entirely.

What got leaked? Everything. Full names, dates of birth, occupations, postal addresses, email addresses, phone numbers. Copies of passports and driver's licenses. Verification selfies. Account statements including IBAN numbers. Withdrawal records. And complete transaction histories for all Bitcoin activity on affected accounts. Customer funds stayed locked down. No facial biometric data. Silver lining on a pretty dark cloud.

Revolut moved quickly once they clocked what happened. Blocked the fraudulent email address across all systems, alerted the government agency in question, notified law enforcement, data protection authorities, and financial regulators. Started contacting affected customers on Friday. All very by-the-book. Except they've been cagey about the details. Exact number of affected customers? They won't say. Which government agency got impersonated? Not disclosing. Was this geographically limited? They're keeping that quiet too.

Blockchain investigator ZachXBT was among the first to flag this publicly, posting affected customer notifications on social media. Security researchers have suggested the breach was deliberately targeted at high-net-worth users. The scope seems narrow. The targeting seems precise. This wasn't indiscriminate; it was fishing for wealthy people.

The incident has kicked up dust around KYC requirements and what happens when financial institutions are legally forced to collect and warehouse mountains of sensitive data. Yes, Know Your Customer rules exist for regulatory compliance. But they also create a concentrated target. Marc Zeller, a crypto figure whose own data was reportedly exposed, made the blunt observation: KYC requirements haven't produced meaningful security benefits whilst doing exactly what critics warned they'd do—exposing customers to elevated risks.

Here's what's instructive for anyone paying attention. Domain authentication protocols are not a complete defense against determined attackers who've gained access to legitimate government infrastructure. Email security standards can be exploited. A financial institution relying entirely on email authentication to verify high-risk data requests is asking for trouble. Out-of-band verification—picking up the phone, using a separate communication channel—that's the thing that actually stops this kind of attack.

Revolut is a prominent fintech company. This is a sophisticated social engineering breach. And it exposed Bitcoin transaction histories along with everything else. That's the story here—not just that someone got scammed, but that someone this large, this integrated into global financial infrastructure, got scammed. The defenses failed at scale.

Source & further reading:

Sources