Revolut says customer KYC, Bitcoin transaction data exposed after fake request from gov't domain

Revolut disclosed sensitive customer information to an unauthorized third party that submitted fraudulent requests for records from a legitimate government agency email domain, the company told TechCrunch on Saturday.

A Revolut spokesperson described the incident to The Block as a "sophisticated external impersonation scam" and said the company blocked the email address after identifying it. The spokesperson said Revolut's systems and customer funds were unaffected.

Revolut said a limited number of customers were affected and that it has contacted them directly, with some of the customers reporting receiving emails on Friday. The company declined to disclose to The Block how many people were affected, whether the incident was confined to a single market, and which government agency domain was used.

The information disclosed may have included customers' names, dates of birth, postal and email addresses, telephone numbers and copies of identity documents including passports and driver's licenses, according to a notification sent to affected customers. Verification selfies, account statements and transaction histories may also have been disclosed.

A copy of Revolut's notice to customers shared publicly by former Mt. Gox CEO Mark Karpelès, who said he was among those affected, said account statements, IBANs, withdrawal records and full transaction histories, including Bitcoin transactions, were among the details that were potentially shared with the unauthorized third party. 

The company also alerted the relevant government agency, law enforcement, data protection authorities and financial regulators, the spokesperson told The Block. 

Onchain investigator ZachXBT alerted his followers to the breach, speculating that the incident may be targeting Revolut users with deep pockets. "While the incident is likely limited in size it seems to have been targeted at high net worth users," ZachXBT wrote. 

Revolut is expanding banking, crypto operations

The incident comes as the British fintech firm seeks to expand its banking and crypto operations in the United States and beyond. 

Earlier this month, Revolut received conditional approval from the U.S. Office of the Comptroller of the Currency as it seeks to establish a national bank in the United States, The Block reported at the time. The proposed bank is expected to offer traditional banking products alongside stablecoin services; Revolut had previously outlined those plans after applying for a de novo banking charter earlier this year.

Revolut also began rolling out EURR, its first euro-backed stablecoin, to selected customers in Denmark, Poland and Portugal in August. The company said at the time that it served 80 million customers globally and planned to expand the stablecoin across the European Economic Area.

The company has also been expanding Revolut X, its standalone crypto trading platform. In July, Revolut connected the exchange to third-party AI assistants including Claude and Gemini, allowing customers to analyze markets and place trades through natural-language prompts, as The Block reported. 

Latest in a string of customer-data exposures

The Revolut incident is the latest in an ongoing string of customer-data security incidents involving crypto and related fintech firms.

Last month, crypto wallet provider SafePal said a flaw in an order-tracking system exposed names, contact information, shipping addresses and purchase details belonging to approximately 39,798 customers. SafePal said private keys, seed phrases and customer funds were unaffected. 

Hardware wallet maker Trezor said last week that a breach at shipping provider ShipMonk affected another roughly 67,000 U.S. customers, substantially expanding the scope of an incident the firm had initially disclosed in August. The exposed information likewise included names, emails, phone numbers, shipping addresses and order numbers. 

Trezor separately disclosed this week that a breach at a third-party email provider enabled phishing emails to be sent from its legitimate domain, an incident bearing some similarities to Revolut's case in that attackers were able to leverage a trusted domain.