Revolut Handed Customers’ Passports and Bitcoin Records to a Fake Government Request. Are You Affected?

Revolut, the London-based digital bank with more than 60 million customers worldwide, handed a bundle of customer files to someone impersonating a government agency. The request arrived from an official-looking email domain, and Revolut’s compliance team treated it as genuine and released the records. On-chain investigator ZachXBT disclosed the incident, and Revolut has sent security notices to the customers whose data went out in the response.

The bank’s system wasn’t compromised, so no customer money was laundered. What failed was the check on whether the request was real, which is a different problem from an intrusion and, in some ways, a harder one to close. The exposed set includes Bitcoin (CRYPTO:BTC) transaction histories alongside government ID and full account records, which is exactly the raw material a competent phisher wants. So who’s on the list, and how would you know?

Revolut Complied With a Spoofed Government Request

A request arrived at Revolut that presented itself as a lawful government demand for customer records, and Revolut’s team treated it as real and answered it. A spoofed domain is one built to imitate a real institution’s address closely enough to pass a human check, and the sender used one. Whoever wrote it knew the format banks expect when law enforcement asks for account data, and knew which specific customers to ask about.

The files that went out cover almost everything a bank holds on a customer. Passports and driver’s licenses, KYC selfies, account statements, IBANs, withdrawal records, and Bitcoin transaction histories all left in the response. KYC, or Know Your Customer, is the identity check a regulated bank runs at signup and stores for the life of the account, which is why the selfie in the file matches the photo page of the passport under the same name.

The failure was authentication of the sender. Revolut’s systems weren’t broken into. A human process, or a partly automated one, decided the request was genuine and released the records. That’s harder to fix than a software bug because it depends on how staff verifies a counterparty under legal-request pressure, and every large bank that handles government demands faces the same problem in some form.

Revolut was Tricked Into Releasing Customers’ Data

What Revolut handed over was a document set, sent by the bank in response to what looked like a normal legal request. The attacker never touched a balance and never held a login credential. What Revolut handed over was a document set, sent by the bank itself in response to what looked like a normal legal request.

A file that names a customer, their home address, their ID photos, their bank flow, and their Bitcoin history is the raw material of a convincing phishing attack. Phishing is a message engineered to look like it comes from someone you trust, so the attacker can extract a password, a two-factor code, or a signed crypto transaction.

A Bitcoin transaction history is more dangerous than a bank statement, because the coins on chain are still there and still yours. A message that quotes your last on-chain withdrawal, the address it went to, and the exact amount reads as if it came from your exchange, and a reader who would never click a generic scam might click this one. Physical risk rises too when an attacker knows both a home address and a rough wallet size.

High-Net-Worth Accounts Look Like the Target

The exposed set looks limited and targeted at high-net-worth accounts, and affected users received security notices from Revolut. That pattern fits an attacker who chose which customers to ask about, rather than one who scraped whatever they could reach. Revolut hasn’t published a full recap, so the total number of affected accounts, the criteria used to pick them, and the internal path the request took aren’t public.

If you’re in that group, the first sign will probably be an email, a phone call or a chat message that already knows details only your bank should know. The contact might reference a recent transfer, quote your IBAN, cite your passport number, or name a Bitcoin address that received a withdrawal from your Revolut wallet. A caller who recites those specifics without prompting is the scenario this file enables, and the correct response is to hang up and open the Revolut app to verify.

Are You Affected?

You’re likely affected if Revolut sent you a security notice, because the bank is contacting people on the list one by one rather than issuing a general disclosure. If you hold a large balance, use Revolut for crypto withdrawals, or completed enhanced KYC as a premium or private customer, you fit the profile the targeting suggests so far. The notice from Revolut is the only definitive confirmation you’ll get, and the absence of one is a reassuring sign without being a guarantee.

What would change the picture is a full recap from Revolut naming the number of accounts affected, the date range of the request, and the internal approval path that let it through, because those specifics decide how widely the phishing risk actually spreads. Until that recap arrives, the answer to whether you’re affected is the one in your inbox. If a notice from Revolut arrived there, treat every unsolicited contact that quotes your account details as hostile until you’ve verified it through the app.

Contact [email protected] for any questions or corrections.