Revolut Handed Customers' Passports and Bitcoin Records to a Fake Government Request. Are You Affected?

Someone impersonated a government agency and tricked Revolut into handing over customer passports, Bitcoin records, and full account histories without breaking a single line of code. If you hold crypto on Revolut, here is what the attacker now knows about…

Revolut, the London-based digital bank with more than 60 million customers worldwide, handed a bundle of customer files to someone impersonating a government agency. The request arrived from an official-looking email domain, and Revolut’s compliance team treated it as genuine and released the records. On-chain investigator ZachXBT disclosed the incident, and Revolut has sent security notices to the customers whose data went out in the response.

The bank’s system wasn’t compromised, so no customer money was laundered. What failed was the check on whether the request was real, which is a different problem from an intrusion and, in some ways, a harder one to close. The exposed set includes Bitcoin (CRYPTO:BTC) transaction histories alongside government ID and full account records, which is exactly the raw material a competent phisher wants. So who’s on the list, and how would you know?

Revolut Complied With a Spoofed Government Request