Hackers Want $3 Million in Monero for Revolut's Stolen Bitcoin Records. What Affected Customers Should Do Now

Attackers posed as Italian law enforcement for months, convincing Revolut to hand over passports, selfies, and full transaction histories on hundreds of high-net-worth crypto holders. Here is what those customers face now and what the stolen files actually allow someone…

This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.

A group that goes by the name iamnotavillain spent months emailing Revolut from an Italian government domain, posing as law enforcement and requesting files on named customers. The requests cleared Revolut’s verification, and the fintech handed over passports, the selfies customers submit for identity checks, addresses, account details and full transaction histories.

Revolut confirmed the disclosure on September 12, 2026, and notified affected customers the same day. On September 16, the group published a demand for 6,000 Monero (CRYPTO:XMR), worth roughly $3 million, with a 24-hour countdown. Revolut says it has received no direct ransom demand, which leaves the 680 people named in those files waiting on a negotiation neither side has opened.

How the Attackers Obtained the Records