Revolut exposed the personal data of a subset of users after failing to flag a fraudulent government data request, on-chain investigator ZachXBT reported.
The exposed records reportedly include copies of passports or driver's licenses and their verification selfies, account statements, IBANs, withdrawal records and full transaction histories, including Bitcoin, alongside names, dates of birth, occupations, home addresses, emails and phone numbers.
The request is said to have come from an email account spoofing a government agency's official domain, complete with valid domain authentication, which appears to have let it slip past Revolut's checks before the customer information was shared.
The incident looks limited in scale but deliberately targeted at high-net-worth users, and Revolut has already emailed affected customers. It is a sharp reminder that a KYC-heavy fintech holds exactly the identity and on-chain footprint an attacker needs to deanonymize crypto holders.
Partner Offers | Get Your Instant BTC Cashback | Your Gateway To Crypto | Arcus Private Whitelist
