Revolut handed over sensitive customer identity data - including copies of passports and complete Bitcoin transaction histories - to criminals after being deceived by actors impersonating official government agencies.
On-chain investigator ZachXBT disclosed the incident publicly, noting that the attack appeared to specifically target high-net-worth users.
A Genuine Domain That Fooled the System
The scammers did not rely on spoofed domains, but instead operated unauthorized email accounts using official government agency domains. The authenticity of the email address convinced Revolut’s team that the data request was legitimate, leading them to disclose customer information.
Revolut described the incident as a sophisticated external impersonation scam. The surrendered information included full names, dates of birth, occupations, postal addresses, email addresses, and phone numbers of the victims.
The attackers also obtained copies of identification documents such as passports or driver’s licenses alongside selfie verification photos. Customers’ financial footprints were also exposed through bank statements containing IBAN numbers, wallet references, withdrawal records, and complete Bitcoin transaction histories. Revolut emphasized that facial biometric data was not handed over to the scammers.
Beyond Data, a Physical Threat
ZachXBT linked the exposure of asset histories tied to physical addresses to the threat of wrench attacks - real-world assaults or robberies targeting crypto holders after their identities are compromised.
Revolut declined to disclose the number of customers whose data was compromised, and also refrained from naming the government agency whose email domain was used by the scammers.
In response, Revolut stated that it blocked the attacker’s email address and reported the incident to the relevant agency, law enforcement, and regulatory bodies. The company maintained that its internal systems remain secure and customer funds were not impacted by the impersonation scam.
For customers whose full identities and Bitcoin wealth records are now in criminal hands, assurances of untouched app balances may no longer be the primary concern. They now face real-world safety risks.
Sourced from Decrypt.
Previously: Revolut Leaks Customer Bitcoin History to Scammers Using Official Government Email
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
