🔓 Revolut handed passports and Bitcoin histories to a fake government request

Someone spoofed a real government agency's email domain, sent Revolut a data request, passed authentication — and Revolut complied.

What leaked: passport copies, verification selfies, home addresses, IBANs and full Bitcoin transaction histories. Investigator ZachXBT says the attack targeted high-net-worth crypto holders — which, amid a wave of violent "wrench attacks" against known holders, makes this more than a data spill.

Revolut confirmed the breach to TechCrunch, calling it "a sophisticated external impersonation scam." How many customers were hit and which agency was impersonated — not disclosed.

KYC collects everything. Who guards the archive is apparently a separate question.

Decrypt