Revolut Leaks Customer Data to Hackers Posing as State Agency

Fintech app Revolut is at the center of a data-exposure incident in which attackers impersonating a government agency obtained sensitive customer information, according to reporting from Bitcoin.com News, CoinDesk and crypto.news. The core failure was not a technical breach of the company's systems but a social-engineering attack: the digital bank treated a fraudulent request as if it were a legitimate one and released customer data in response.

According to CoinDesk's summary of the incident, the material handed over included passports, selfies and home addresses. Crypto.news reported that bitcoin-related account records were also exposed as a result of the fake agency request. Importantly, all three outlets indicate that no customer funds were lost, meaning the damage appears to be informational rather than financial at this stage.

That distinction matters, but it does not make the exposure trivial. Identity documents, facial images and residential addresses are exactly the inputs needed for downstream identity theft, account-takeover attempts and targeted phishing. In the crypto context, records linking a named individual to bitcoin holdings can be especially sensitive, because they can help attackers identify which accounts are worth pursuing and can raise physical-security concerns for people known to hold digital assets. Data of this kind also tends to circulate and resurface long after the original incident.

The episode highlights a category of risk that is increasingly common across both traditional finance and crypto: the abuse of legal-process channels. Banks, exchanges and fintechs routinely receive data requests from law enforcement and regulators, and they are generally obliged to respond. Attackers have learned that forging or spoofing such a request can be far easier than breaking encryption or compromising infrastructure. Because these requests arrive through official-looking channels and often carry urgency and confidentiality demands, they can bypass the skepticism that would normally greet an unsolicited request for customer records.

The Revolut incident lands amid a broader run of security-related headlines in the sector. Crypto.news reported in the same period that law firm documents have appeared on the dark web as cyberattacks rise, and that the Bank for International Settlements has warned that artificial intelligence could compress the window banks have to patch vulnerabilities down to minutes. Taken together, these stories point to an environment in which attackers are moving faster and relying more heavily on manipulating people and processes rather than only exploiting code.

For users, the practical implications are about exposure management rather than market positioning. Where identity documents may have been compromised, the standard response is heightened vigilance against phishing attempts that reference real personal details, caution with unsolicited contact claiming to be from the provider or from authorities, and use of strong authentication methods such as hardware security keys where available. Users concerned about their own exposure should look to official communications from the company involved rather than to third-party claims circulating on social media, since incidents like this are frequently followed by opportunistic scams that impersonate the affected firm's support channels.

For firms, the incident is a reminder that verification procedures for inbound legal and governmental requests are a security control in their own right, requiring independent callback verification and internal escalation rather than acceptance at face value.

Broader market conditions at the time of reporting were subdued, with CoinDesk showing bitcoin near $76,800 and ether near $2,480, both modestly lower on the day. Further details on the scope of the Revolut exposure and any regulatory response are likely to emerge as the company and relevant authorities comment.

This is a news summary for general information only — not financial advice, and nothing here is a recommendation to buy, sell, or hold any asset. Always verify against the original source and do your own research before making a financial decision.