Revolut Leaks Passports, Bitcoin Transaction Histories to Fake Government Request

In brief

• Revolut disclosed sensitive customer data—including passport copies, verification selfies and full Bitcoin transaction histories—after fulfilling a fraudulent request sent from a government agency's legitimate email domain.
• A Revolut spokesperson confirmed it was "a sophisticated external impersonation scam," said a "limited" number of customers were affected, and stated systems and funds were unaffected, but declined to give numbers or name the agency.
• ZachXBT said the breach appeared to target high-net-worth users, raising "wrench attack" concerns amid a wave of similar leaks.

Fintech giant Revolut handed sensitive customer data, including passport copies and full Bitcoin transaction histories, to a malicious actor after falling for a fraudulent request disguised as a legitimate government inquiry.

According to a customer notification circulated by crypto investigator ZachXBT, Revolut received a request for customer information that appeared to come from a government agency, sent from an unauthorized email account using the agency's official domain.

Because the message carried valid domain authentication credentials, Revolut fulfilled it in the belief it was genuine.

The exposed data was extensive. Per the notice, it spanned identity details such as full name, date of birth and occupation; contact information including postal address, email and phone number; and document and verification data, including a copy of the victim's passport or driver's license and the selfie provided for verification.