Revolut released passports and Bitcoin histories on an email that passed domain authentication
The request came from an unauthorized account on a real government domain, and Revolut acted on it. The company calls the number of affected customers limited, and it declined to say how many or name the agency.
The Investor · Invest desk
What happened
- Revolut handed a fraudulent requester passport copies, verification selfies and full Bitcoin transaction histories after a request arrived from a government agency's legitimate email domain.
- The request came from an unauthorized account on the agency's official domain, and Revolut fulfilled it because the message carried valid domain authentication credentials.
- The financial data released covers account statements with IBAN and wallet reference numbers, withdrawal records and full transaction history, including Bitcoin.
- Revolut said a limited number of customers were affected, that it had blocked the email address, and that it alerted the agency, law enforcement and regulators.
- ZachXBT said the incident appeared to target high-net-worth users, a concern given the surge in violent wrench attacks against known crypto holders.
Why it matters
- What it limits constraint Domain authentication tells a disclosure desk which mail server sent the message; entitlement to ask is a separate question, so a bank gating on that check alone has no control standing between a real government domain and a hijacked account inside it.
- Who's exposed exposure The released file joins a named person at a known postal address to wallet references and a complete transaction history, giving anyone planning physical coercion both a target and an estimate of holdings.
- What it sets up precedent With the agency unnamed, every other firm that answers requests from that domain is working blind, and the same sender can try the next institution on the list.
- Who has to decide decision Revolut now chooses whether to publish a customer count and the agency's name itself, or leave both to be established by regulators and IPO diligence.
Next story · Invest · Sep 17
Hackers priced 680 Revolut customer files at roughly $4,300 eachConfirmed3 publishers
An unauthorized account sent the request, and its domain credentials were valid. Both of those facts come from the same customer notification, circulated by the crypto investigator ZachXBT [2]. The check confirmed which domain the mail left. Whether the sender had authority to ask was a separate question [19].
The notice lists a copy of the passport or driver's licence and the selfie the customer provided for verification [5]. Those are the documents Revolut used to verify the customer's identity, and they are now with whoever sent the email [15]. Revolut said no biometric facial telemetry data was involved [11].
A Revolut spokesperson confirmed the breach to TechCrunch, describing it as "a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information" [9]. The company said its systems and customer funds were unaffected [10]. The only quantity on the record is the word "limited" [16].
Revolut launched its euro-pegged EURR stablecoin this year and is weighing an IPO [13]. An incident with no stated size is one a diligence process will size for itself, and I would expect the count to be established there before it is published.
Two readings fit the record. In the first, one company's manual review failed, and confirming a requester through a published agency phone number closes the hole cheaply. In the second, the request channel is the soft spot at every regulated firm holding identity documents, and Revolut is one route among several open at once: Trezor's support-vendor breach widened to expose tens of thousands more customers, and X appeared to suffer a breach that flooded users with password resets [17][18].
Marc Zeller wrote on September 12, 2026: "Woke up to all my data leaked by @Revolut. Sharp reminder that KYC hasn't produced meaningful upside and has put many in harm's way." [14] The record supports the narrower version of that. The file exists because identity rules require it, and it moved because an email check was treated as proof of authority [19]. What would break the reading is a small count paired with a compromised mailbox inside the agency, which would make this a targeted operation against named individuals rather than a workflow any forger can run.
What to watch
- Whether Revolut or a regulator names the impersonated agency, which would let peer firms check their own request logs.
- Any count filed with a data protection regulator or disclosed in IPO documents that puts a number behind "limited".
- Whether Revolut adds non-email confirmation of law-enforcement requesters, and whether rival banks say they already require it.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence66
Perspective Coverage
5 publishers- Builder
- Builder 23%
- Operator
- Operator 55%
- Investor
- Investor 22%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Revolut disclosed sensitive customer data, including passport copies, verification selfies and full Bitcoin transaction histories, after fulfilling a fraudulent request sent from a government agency's legitimate email domain.
- [2]
According to a customer notification circulated by crypto investigator ZachXBT, Revolut received a request for customer information that appeared to come from a government agency, sent from an unauthorized email account using the agency's official domain.
- [3]
Because the message carried valid domain authentication credentials, Revolut fulfilled it in the belief it was genuine.
- [4]
The exposed data spanned identity details such as full name, date of birth and occupation, and contact information including postal address, email and phone number.
- [5]
The exposed data included a copy of the victim's passport or driver's license and the selfie provided for verification.
- [6]
Revolut said a "limited" number of customers were affected, that it had blocked the email address and alerted the agency, law enforcement and regulators.
- [7]
The financial data disclosed included account statements with IBAN and wallet reference numbers, withdrawal records and full transaction history, including Bitcoin.
- [8]
ZachXBT said the incident appeared to target high-net-worth users, a concern given the surge in violent "wrench attacks" against known crypto holders.
- [9]
A Revolut spokesperson confirmed the breach to TechCrunch, describing it as "a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information".
- [10]
Revolut said its systems and customer funds were unaffected.
- [11]
Revolut said no biometric facial telemetry data was involved.
- [12]
Revolut declined to say how many people were hit or which agency was impersonated.
- [13]
Revolut, which launched its euro-pegged EURR stablecoin this year, is currently weighing an IPO.
- [14]
Marc Zeller wrote on September 12, 2026: "Woke up to all my data leaked by @Revolut. Sharp reminder that KYC hasn't produced meaningful upside and has put many in harm's way."
- [15]
The disclosed set includes both verification artefacts named in the notice, the passport or driver's licence image and the selfie provided for verification.
- [16]
The only quantity Revolut has given for the number of affected customers is the word "limited".
- [17]
Hardware wallet maker Trezor recently saw a support-vendor breach widen to expose tens of thousands more customers.
- [18]
X appeared to suffer a data breach of its own that flooded users with password resets.
- [19]
The email that triggered the disclosure carried valid domain authentication credentials while originating from an unauthorized account on that domain, so the check that passed established the sending domain and not the sender's authority to request customer data.
- [20]
The disclosed file links a named individual, date of birth and postal address to wallet reference numbers, withdrawal records and a complete transaction history.
- [21]
With the impersonated agency unnamed, other institutions that receive requests from that domain have no identifier to search their own mail logs against.
Sources
5 independent publishers whose own reporting we read for this story.
- cointelegraph.comRevolut says customer data exposed through fake government email
1 article · September 13, 2026
- crowdfundinsider.comRevolut Reportedly Released Customer Passports and Bitcoin Transaction Logs after Fake Government Email
1 article · September 13, 2026
- cryptobriefing.comRevolut confirms customer data breach from fake government requests
1 article · September 12, 2026
- decrypt.coRevolut Leaks Passports, Bitcoin Transaction Histories to Fake Government Request
1 article · September 12, 2026
- pymnts.comRevolut Reveals Customer Data Leaked in Email Scam
1 article · September 13, 2026