Revolut discloses customer passports and Bitcoin histories to fraudulent government request

September 12, 2026 at 08:30 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Revolut disclosed wealthy customers' identity documents, addresses, and Bitcoin transaction histories after accepting a fraudulent government data request. The request came from an unauthorized mailbox inside a genuine government domain and carried valid authentication credentials. Affected customers were notified Friday, while Revolut has not identified the agency or disclosed how many customers were affected.

Key Facts

Revolut disclosed customers' passports, verification selfies, and Bitcoin transaction histories after treating a fraudulent government request as legitimate.
The request came from an unauthorized mailbox inside the domain infrastructure of a genuine government agency and carried valid authentication credentials.
Affected customers were told Friday that disclosed information could include passport or driver's license copies, verification selfies, names, dates of birth, occupations, home addresses, phone numbers, IBANs, and account statements.
Revolut has not identified the agency or disclosed how many customers were affected.
Onchain investigator ZachXBT said the disclosure appeared limited in scale and may have targeted high-net-worth customers.

The Fraudulent Request

The attacker used an unauthorized mailbox inside a genuine government domain, allowing the request to clear Revolut's authentication controls. Revolut subsequently contacted the agency, concluded the request was fraudulent, blocked the address, and began notifying customers and regulators. The company has not identified the agency or explained why it released records before confirming the request outside email.

Customer Backlash

Marc Zeller, founder of the Aave Chan Initiative, said the disclosure came shortly after Revolut demanded additional information from him, threatening to close his account. He accused the company of doing the attackers' work for them after the request fooled him. The criticism cuts into a tension created by modern financial compliance, as banks and fintech firms collect extensive identity and transaction records to satisfy know-your-customer and anti-money laundering requirements.

Bitcoin Exposure

For Bitcoin holders, the exposed records could give an attacker far more than a financial statement. Bitcoin transactions are recorded on a public blockchain, meaning information tying a known person to specific activity can potentially help map that individual's wider onchain footprint. Onchain investigator ZachXBT, who publicized the incident, said the disclosure appeared limited in scale and may have targeted high-net-worth customers.