Revolut has confirmed a customer data exposure in which identity documents and, according to reviewed customer notices, Bitcoin transaction histories were handed to an unauthorized third party after fraudulent information requests were sent using a legitimate government agency email domain.
Revolut has confirmed a customer data exposure in which identity documents and, according to reviewed customer notices, Bitcoin transaction histories were handed to an unauthorized third party after fraudulent information requests were sent using a legitimate government agency email domain. The incident underscores a recurring tension for Bitcoin holders: exchanges and neobanks retain detailed records that link a person’s identity to their on-chain financial activity.
WHAT TO KNOW
- Revolut confirmed that identity and contact details, with financial records reportedly including Bitcoin activity, were released to a third party posing as a government requester.
- The exact number of affected customers, the impersonated agency, the affected markets and the precise date of the fraudulent disclosure remain undisclosed.
What the Revolut Bitcoin Data Exposure Claim Says
Revolut confirmed that an unauthorized third party obtained sensitive customer information through fraudulent requests sent from a legitimate government agency email domain, a company spokesperson told TechCrunch, which reviewed the notification sent to affected customers. For related coverage, see Revolut Says KYC, Bitcoin Data Exposed After Fake Request.
The notice listed identity and contact details, including birth dates, postal and email addresses, telephone numbers, and copies of passports or driver’s licenses among the exposed data. Revolut’s notification also said verification selfies, account statements and transaction histories may have been included, language that stops short of confirming every field for every affected customer. For related coverage, see Revolut Discloses Bitcoin Histories After Fake Govt Request.
Decrypt, reviewing the same customer notice, reported that the exposed financial records described IBAN and wallet reference numbers, withdrawal records and full transaction histories including Bitcoin. That detailed Bitcoin scope is attributed to the reported notice rather than to any independent forensic finding, and the individual scope of what each customer lost is unknown. For related coverage, see Revolut Exposes Bitcoin Activity in Fake Request Incident.
The affected-customer count, the incident date and the jurisdictions involved are not established in the available reporting. The parallel accounts collected in coverage of how Revolut said KYC and Bitcoin data were exposed after the fake request agree on the categories of information without resolving the numbers, and readers should treat the precise scope as open. For related coverage, see Revolut Leak Claim Links Bitcoin Wallets to Home Addresses.
Questions About the Alleged Fake Government Request
The sequence reported so far, a fraudulent request followed by a disclosure, is a chronology, not a verified technical explanation of how the release was authorized. A legitimate government email domain does not by itself demonstrate a valid legal demand, and the specific legal basis and request-validation process behind this disclosure are unknown. For related coverage, see Hackers Reportedly Obtained Revolut Passports, Bitcoin Data.
The claimed authority, the submission channel, the request authentication and the internal release authorization all remain details requiring corroboration. No independent forensic report has established how the agency-domain email account was used or which controls failed, so there is no basis to claim a proven domain spoof or a server intrusion.
Revolut said its systems and customer funds were unaffected, a company statement rather than an independently audited finding. The company also said it blocked the email address and alerted the relevant government agency, law enforcement and regulators after discovering the scam; the authorities were not named, and no incident-specific regulatory penalty has been established.
Revolut told TechCrunch that a limited number of customers were affected and contacted directly, without disclosing an exact count. TechCrunch published its confirmation on September 12, 2026, noting that on-chain investigator ZachXBT posted about the customer email late Friday; the report does not fix the exact time of the fraudulent disclosure. Coverage detailing how Revolut disclosed Bitcoin histories after the fake request has similarly preserved these gaps.
According to unconfirmed reports, the incident specifically targeted high-net-worth customers, an assessment TechCrunch attributes to ZachXBT and that Revolut did not confirm. According to unconfirmed reports, every affected customer’s complete Bitcoin transaction history and verification selfie were disclosed, but the reporting preserves may-have-included language and does not establish individual scope.
Privacy Implications for Revolut Bitcoin Users
Linking government-issued identity documents with a record of Bitcoin activity is precisely the combination that creates privacy and targeted-phishing risk, because it ties a real-world identity to a financial profile. Those are conditional risks raised by the data categories, not outcomes observed in this incident.
The available material does not establish exposure of login credentials or private keys, account takeover, or any loss of Bitcoin. The distinction matters: custodial identity records are not the same as the cryptographic keys that control coins, and reporting that a wallet reference number appeared in a notice is not evidence that any Bitcoin moved. Accounts of how the leak claim links Bitcoin wallets to home addresses illustrate the deanonymization concern without proving downstream theft.
General precautions apply for anyone concerned. UK guidance from the Information Commissioner’s Office advises checking bank statements and credit files, verifying unexpected contacts through known official channels rather than links in messages, and considering CIFAS protective registration, which prompts additional checks on financial applications. Customers should rely on official in-app communications and contact support through official channels about any suspicious request, keeping those steps separate from incident-specific instructions Revolut has not published.
For Bitcoin holders, the episode reinforces the fundamentals that distinguish the network from the custodial layer built on top of it. The base protocol’s security, from its proof-of-work issuance to self-custody through private keys, is unaffected by a data disclosure at a financial intermediary; the exposure here is a records problem, and it is a reminder that KYC data retained off-chain remains a standing liability no difficulty adjustment can repair.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
