ZachXBT, a prominent on-chain investigator, issued a warning on his Telegram channel that Revolut had transferred user data to an unauthorized third party. The request was sent from an email address under a government agency’s domain, leading Revolut to believe it was a legitimate request.
The exposed data includes full names, contact information, copies of identity documents, verification selfies, IBAN numbers, bank statements, withdrawal histories, and complete Bitcoin transaction histories. ZachXBT stated that the number of affected accounts was limited, but noted that the attack may have specifically targeted high-net-worth users. Several victims have already received official notification emails from Revolut.
The most concerning aspect is not a technical vulnerability, but the attack vector itself: the bad actors did not hack Revolut’s systems, but instead exploited the credibility of a government agency by sending the request from a genuine domain email. This scheme, known as a “fraudulent legal request,” has previously surfaced at other major tech companies.
The incident comes as Revolut is aggressively expanding its crypto services. The company boasts more than 50 million users globally and has secured a MiCA license in Europe. The breach raises questions about government request verification procedures at fintech firms handling sensitive financial data.
Revolut has not issued a detailed comment beyond confirming that a “limited number” of affected users have been notified. The company stated that it is reviewing its procedures for handling legal requests.