Fintech giant Revolut, which offers banking, lending, investing, and crypto services to more than 80 million customers worldwide, has exposed sensitive customer data to an unauthorized third
Fintech giant Revolut, which offers banking, lending, investing, and crypto services to more than 80 million customers worldwide, has exposed sensitive customer data to an unauthorized third party, TechCrunch reported on Sep. 12.
Founded in 2015, the British fintech giant announced early this month that it has received conditional approval from the U.S. Office of the Comptroller of the Currency (OCC) for its U.S. national bank charter.
Related: 67,000 more Americans using Trezor exposed to data breach
TechCrunch said a Revolut spokesperson confirmed the data breach, calling it "a sophisticated external impersonation scam."
The report cited on-chain analyst ZachXBT, who posted the email Revolut sent to affected customers late Friday.
According to ZachXBT, the exposed identity-related data includes the following.
The exposed financial data includes the following.
Revolut alert shared by ZachXBT on Telegram channel "Investigations by ZachXBT" ZachXBT said the incident appeared to target high net worth users. Revolut said a limited number of customers were affected but did not disclose how many.
The Street Roundtable reached out to Revolut for more details on affected crypto users but had not received a comment by the time of publication. We will update this report when the company responds.
Revolut said it received fraudulent information requests sent from a legitimate government agency email domain.
Though the email account itself was unauthorized, it used the government agency's official domain. Revolut fulfilled the request, believing it to be genuine.
Once Revolut became aware of the data leak, it blocked the email address and alerted the affected users, the relevant government agency, law enforcement, and relevant regulators.
Revolut said its systems and customer funds were unaffected.
The Revolut leak is particularly concerning for crypto users because the attacker now has both their Bitcoin transaction histories and their postal addresses. In the worst case, that combination can lead a bad actor to a victim's doorstep.
Blockchain analytics firm Chainalysis reported last month that violent attacks targeting crypto holders, including home invasions, kidnappings, and hostage situations, have surged in recent years.
Criminals know a single person might hold millions of dollars in a wallet on a smartphone, and physical threats can force an immediate transfer.
According to the report, violent criminals have successfully extracted more than $30 million from crypto holders so far this year.
Attacks 2023-2026, Source: ChainalysisThe share of home invasions among violent attacks targeting crypto users has risen from 26% in 2023 to 37% in 2026 so far, Chainalysis said.
France, the U.S., Brazil, and Thailand have recorded the most such incidents since 2023, but France has seen a sharp surge in crypto-related violent incidents over the past year.
Related: Legendary short-seller who bet against Enron sends new warning
