Revolut Leaks Passports, Bitcoin Data to Impersonation Scam — SkimNews
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- Revolut disclosed passport copies, verification selfies, and full Bitcoin transaction histories after fulfilling a fraudulent request that appeared genuine because it carried valid domain authentication credentials from a government agency's official domain.
- A Revolut spokesperson confirmed it was "a sophisticated external impersonation scam," said a "limited" number of customers were affected, stated systems and customer funds were unaffected, but declined to give numbers or name the impersonated agency.
- The exposed data spanned identity details (name, DOB, occupation), contact info, document copies, account statements with IBAN and wallet reference numbers, withdrawal records, and full transaction histories—but no biometric facial telemetry.
- ZachXBT said the breach appeared to target high-net-worth users, raising "wrench attack" concerns amid a surge in violent attacks against known crypto holders, and users on social media argued KYC rules have created risk without meaningful benefit.
- The breach lands alongside a widening Trezor support-vendor breach exposing tens of thousands more customers and an apparent X data breach flooding users with password resets.
- Revolut, which launched its euro-pegged EURR stablecoin this year, is currently weighing an IPO.
Why it matters: The breach lays bare the KYC paradox: users surrendered their most sensitive personal data to comply with regulations, and criminals may now use it to physically target wealthy holders. Revolut's refusal to disclose the number affected or the agency impersonated leaves victims unable to gauge exposure—just as the fintech weighs an IPO that will heighten scrutiny of its data-handling.
Ask SkimNews
