Revolut released passports and Bitcoin records after fraud

Revolut released customers’ passports, driver’s licenses, verification selfies, names, dates of birth, occupations, home addresses, phone numbers, IBANs, account statements, withdrawal records and full transaction histories, including Bitcoin, after treating a fraudulent request as legitimate. The company told affected customers on Friday that those categories of data may have been disclosed.

Revolut said the request originated from an unauthorized mailbox operating inside the domain of a genuine government agency and passed standard email authentication checks — SPF, DKIM and DMARC. Because the message appeared authenticated, staff treated the request as coming from an official authority. Revolut then contacted the agency separately, concluded the mailbox had been compromised, blocked the sender and began notifying customers and regulators. The firm has not named the agency or provided a figure for how many clients were affected.

Revolut confirmed no customer funds were stolen and that the disclosed material did not include passwords, card PINs or cryptocurrency private keys.

Bitcoin transactions are public on the blockchain. Documents that tie a named individual to specific on‑chain activity can be used to trace other transactions linked to that person. Onchain investigator ZachXBT, who publicized details of the incident, reported the disclosure appeared limited in scale and may have targeted high‑net‑worth customers.

Marc Zeller, founder of the Aave Chan Initiative, wrote that the disclosure followed a Revolut notice demanding “a LOT of data” or threatening account closure, and accused the firm of effectively assisting attackers by honoring the request. Former Mt. Gox CEO Mark Karpelès circulated a copy of the notice and argued that identifying the compromised agency could help other banks and exchanges check whether they received similar demands from the same mailbox.

The fact the email passed domain authentication has raised questions about verification procedures at Revolut and elsewhere. Revolut has not detailed whether it requires confirmation of government information requests by phone or other channels, why it contacted the agency only after releasing records, or what procedural changes it has implemented while the investigation continues.

Revolut reported it alerted officials to the unauthorized mailbox, blocked the sender internally and is carrying out an internal review while notifying affected customers and relevant regulators. The company said the full scope of the release and the chain of events that led to the disclosure remain under investigation.