- Revolut confirmed an unauthorized party used a mailbox on a legitimate government agency domain to obtain customer records.
- Customer notices list passports or driver’s licenses, verification selfies, IBANs, withdrawal records and full Bitcoin transaction histories.
- The firm said a limited number of customers were affected, funds were not compromised, and the exact headcount and agency have not been named.
- Onchain investigator ZachXBT said the incident appeared limited and may have targeted high-net-worth users.
Revolut disclosed sensitive know-your-customer files and Bitcoin transaction histories belonging to a limited group of customers after it treated fraudulent information requests as genuine government demands, the London-based fintech confirmed on Saturday.
A spokesperson described the episode as a “sophisticated external impersonation scam” in which “an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.” Revolut said it blocked the address after identifying the activity, contacted the agency, and notified law enforcement and regulators. Systems and customer funds were unaffected, according to the same statement reported by The Block.
The company has not published a headcount, named the agency, or said whether the incident was confined to a single market. Notices that began reaching customers on Friday, Sept. 11 said the request came from an unauthorized mailbox created inside an official government domain and carried valid authentication credentials, which led Revolut to fulfill it. Former Mt. Gox chief executive Mark Karpelès posted excerpts of that notice and said he was among those contacted.
According to the notice text circulated by Karpelès, the material that may have been provided included full name, date of birth and occupation; postal address, email and phone number; copies of a passport and/or driver’s license plus the onboarding verification selfie; and account statements listing IBAN, account status, opening date and wallet reference numbers, together with withdrawal records and full transaction history, including Bitcoin. Revolut said no biometric facial telemetry was involved. Coverage of the customer notices also states that passwords, card PINs and crypto private keys were not described as having left the firm, and that no customer funds were reported stolen.
Onchain investigator ZachXBT flagged the notices on Friday and said the disclosure appeared limited in scale and may have been aimed at high-net-worth users. That combination of government identity documents, home addresses and Bitcoin activity is the raw material for targeted phishing or physical threats, even though Revolut’s core banking systems were not breached. The firm, which serves more than 80 million customers globally, has declined to identify the compromised agency while a police investigation is underway.
