Revolut has told TechCrunch that some customers' sensitive information was disclosed to an unauthorized third party after fraudulent requests arrived from a legitimate government agency email
Revolut has told TechCrunch that some customers' sensitive information was disclosed to an unauthorized third party after fraudulent requests arrived from a legitimate government agency email domain, with the possible Revolut data leak spanning identity records and, according to secondary reporting, Bitcoin transaction data, even as the company says its systems and customer funds are unaffected.
The confirmation, delivered through original reporting by Jagmeet Singh on September 12, 2026, frames this as a customer-data disclosure triggered by social engineering rather than a breach of Revolut's internal infrastructure, according to TechCrunch. A company spokesperson said a limited number of customers were impacted and that Revolut contacted those affected directly, though no exact affected-customer count was disclosed. For related coverage, see Bitcoin Suisse Plans to Cut Up to Half of Swiss Staff.
This is the second data-exposure episode to surface around the fintech, following earlier coverage of Revolut users' personal information being reportedly exposed, and it lands as the company continues expanding into regulated banking and crypto rails. For related coverage, see Bitmine Buys 28,086 ETH: Ethereum Purchase Explained.
Revolut confirmed it disclosed sensitive customer information to an unauthorized third party after fraudulent requests were sent from a legitimate government agency email domain, per TechCrunch's reporting. The recipient was not an authorized government body; the requests only appeared to originate from one.
The customer notification reviewed by TechCrunch identified exposed identity and contact information, including birth dates, postal and email addresses, phone numbers, and copies of passports or driver's licenses. Revolut's notice also said the data may have included verification selfies, account statements and transaction histories, categories the company qualified as possible rather than confirmed for every affected user.
At the headline level, the two categories in question are know-your-customer (KYC) identity records and Bitcoin transaction data. The "may have leaked" qualifier is material: Revolut's own notice separates confirmed exposure of identity fields from the conditional categories such as selfies and transaction histories.
Bitcoin-specific details, including transaction histories, wallet reference numbers, IBANs and withdrawal records, were reported by Decrypt, which attributed them to the customer notice. According to unconfirmed reports, no biometric facial telemetry data was involved; the TechCrunch report does not separately enumerate the Bitcoin, IBAN or wallet categories, so these should be treated as single-source claims.
Revolut told TechCrunch: "Revolut systems and customer funds are unaffected." That statement is a company assurance rather than the output of an independent technical audit or forensic review.
The disclosure of customer records and the safety of customer balances are distinct aspects of this incident. An assurance that funds are untouched does not establish that no data was exposed, nor does it eliminate the downstream privacy and fraud risk that leaked KYC documents and transaction records can create for the affected users.
Revolut said it blocked the email address and alerted the relevant government agency, law enforcement and relevant regulators, according to TechCrunch. The fetched reports do not identify those authorities or establish any enforcement action, legal violation or regulatory finding.
Several core facts are not established by the available reporting. The company characterized the affected population only as a limited number of customers, a qualitative description and not a numeric count.
No exact affected-customer figure, implicated government agency, geographic market or precise incident date has been disclosed. September 12, 2026 is the reporting date, not a verified breach date; Revolut declined to identify the agency and did not answer whether the incident was limited to a specific market, per TechCrunch.
The mechanics of how the fraudulent request cleared Revolut's checks are not independently verified. Decrypt reported, according to unconfirmed reports, that the request passed because it carried valid domain authentication credentials, but no email headers, forensic report or original notice was directly examined. An open process question is the difference between authenticating a government email domain and validating the legal authority of the individual making a data request, a distinction the fetched reports do not resolve.
The absence of these details reflects what has not yet been publicly disclosed, not evidence of concealment or a confirmed ongoing investigation beyond the notifications Revolut says it made.
KYC data refers to the identity and verification records financial institutions collect under anti-money-laundering rules. The confirmed identity fields in TechCrunch's account, birth dates, addresses, phone numbers and identity-document copies, are what makes this exposure consequential for impersonation and phishing risk, independent of any fund movement.
Bitcoin transaction data, as a category, describes records of activity, not the Bitcoin itself. Exposure of transaction histories or wallet reference numbers, where it occurred, is separate from Revolut's statement that funds are unaffected, and does not by itself imply exposure of private keys, wallet credentials or account balances. Revolut's crypto footprint has widened alongside moves such as its euro-pegged EURR stablecoin launch and its conditional OCC approval for a U.S. national bank charter, raising the stakes for how it handles regulated customer records.
For holders and traders, the actionable risk is targeted fraud built on leaked KYC documents, not a threat to on-chain balances. The reported claim that the incident targeted high-net-worth users, attributed by TechCrunch to on-chain investigator ZachXBT, is, according to unconfirmed reports, unconfirmed by the company and worth watching if verified, given the elevated phishing exposure such users face.
For policy watchers, the concrete triggers ahead are whether Revolut or a named regulator publishes an incident-specific disclosure, whether an affected-customer count emerges, and whether the implicated agency is identified. Bitcoin itself showed no incident-linked market reaction as of September 13, 2026, consistent with an off-chain records disclosure that does not touch settlement or custody.
Revolut confirmed to TechCrunch that it disclosed sensitive customer information to an unauthorized third party after fraudulent government-domain requests. Some categories, such as verification selfies and transaction histories, were qualified as possible rather than confirmed for every user.
Confirmed identity fields include birth dates, addresses, phone numbers and identity-document copies. KYC records more broadly and Bitcoin transaction data may also be involved; the Bitcoin-specific categories rest on single-source reporting from Decrypt.
Revolut says its systems and customer funds are unaffected. That is a company statement, not an independent audit.
Revolut described the impact as a limited number of customers and contacted them directly. No numeric count or geographic scope has been disclosed.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post Revolut Says KYC and Bitcoin Data May Have Leaked was initially published on Coincu.
