Revolut Hackers Demand $3M Monero Ransom, Threaten to Sell Customer Data: Report

In brief

• A group calling itself iamnotavillain has demanded 6,000 XMR, around $3 million, within 24 hours.
• It says it used blockchain analysis to find Revolut accounts with large crypto holdings.
• Revolut says it has received no direct contact or demand.

A criminal group has put a 24-hour clock on Revolut, demanding $3 million in Monero or it will sell hundreds of customers' identity documents and transaction records to other criminals, the Financial Times reported.

The demand, posted Wednesday on a website the group set up for the purpose, asks for "6,000 XMR / $3,000,000" and warns that otherwise "all the data will be sold, and the blood will be on your hands."

Monero, a privacy coin, obfuscates sender, recipient and amount information using ring signatures and stealth addresses. It has been delisted by major crypto exchanges including Binance, Coinbase and Kraken.

Extortion groups ask for it and sometimes discount their demands for victims who pay in it, according to TRM Labs, but most ransoms are still settled in Bitcoin, which it describes as "far easier to acquire, move, and convert at scale."

What distinguishes this breach is how the victims were chosen. The group told the FT it ran blockchain analysis first, picking out Revolut customers whose on-chain activity suggested substantial holdings, and then went after those specific accounts.