Revolut Leaks Passports, Bitcoin Transaction Histories to Fake Government Request

Revolut recently revealed that sensitive customer data, including passport copies and complete Bitcoin transaction histories, was exposed after the company fulfilled a fraudulent request, leading to what can be described as Revolut Leaks Passports. The incident originated from an email account that used a legitimate government agency's official domain.

A spokesperson for Revolut confirmed the incident, characterizing it as a sophisticated external impersonation scam. The company stated that a limited number of customers were affected and that its internal systems and customer funds remained secure.

Revolut received a request for customer information that appeared to be from a government entity, sent from an unauthorized email account but leveraging the agency's official domain. Due to valid domain authentication credentials, Revolut processed the request, believing it to be legitimate.

The compromised data was extensive, encompassing identity details such as full names, dates of birth, and occupations. It also included contact information like postal addresses, email addresses, and phone numbers, as well as document and verification data, including copies of passports or driver's licenses and verification selfies.

For cryptocurrency holders, the financial data exposed was particularly concerning, including account statements with IBANs and wallet reference numbers, withdrawal records, and full Bitcoin transaction histories. Revolut clarified that no biometric facial telemetry data was compromised.

Crypto investigator ZachXBT indicated that the breach appeared to target high-net-worth users, raising concerns about potential “wrench attacks.” Revolut did not provide specific figures regarding the number of affected individuals or identify the government agency involved.

Following the discovery, Revolut blocked the fraudulent email address and reported the incident to the relevant government agency, law enforcement, and regulatory bodies. The incident adds to a series of data security challenges faced by firms handling cryptocurrency user data, including recent breaches affecting hardware wallet providers and social media platforms. Revolut, which launched its EURR stablecoin earlier this year, is currently considering an initial public offering.