Revolut Disclosed Bitcoin Records After Fraudulent Government Request
Revolut fulfilled a fraudulent information request sent from a spoofed government agency email domain, exposing passports, Bitcoin transaction histories, and personal data for a limited number of users. No customer funds were lost, but the breach reveals critical gaps in the company's verification procedures for official data demands.
Written by CoinArticle’s AI Newsroom · from 5 cited sources. How we work
Story Updates
- Updated Sep 12, 2026, 06:05 PM: Decrypt reporting confirms request used spoofed government email domain; no comprehensive public remediation statement from Revolut released.
- Updated Sep 12, 2026, 01:07 PM: CryptoPotato confirms scope of exposed data included identity documents and financial records alongside crypto activity.
- Updated Sep 12, 2026, 01:01 PM: CoinDesk confirms passports, selfies, and home addresses were disclosed; no customer funds were lost.
How the Fraudulent Request Succeeded
Revolut fulfilled an information request that originated from a fraudulent email appearing to come from a government agency's own domain, according to reporting from CoinDesk, CryptoPotato, and Decrypt. The company disclosed customer identities, passports, selfies, and home addresses alongside full Bitcoin transaction histories without verifying the legitimacy of the requester. The fraudulent nature of the request was only discovered after the data had already been released.
Scope of Exposed Information
The disclosed data included customer passports, selfies, residential addresses, and complete Bitcoin transaction records tied to personal identities. Revolut confirmed that no customer funds were lost in the incident. The company has not released a comprehensive public statement detailing the full breach scope or the number of affected users beyond confirming it was a "limited" number. The extent of remediation steps or notification procedures remains unclear as of publication.
Verification Failures and Regulatory Risk
The incident exposes a critical vulnerability in how financial service providers authenticate law enforcement and regulatory data requests. For fintech and crypto-adjacent platforms, distinguishing between legitimate government demands and forged ones is foundational to data protection. Revolut's failure to verify the request—despite it originating from a spoofed government domain—suggests either insufficient verification procedures or a failure to follow existing protocols. The breach is likely to prompt regulatory scrutiny of how platforms validate official disclosures and may accelerate mandates for multi-factor verification and cryptographic request signing.
Why It Matters
For Traders
Revolut users should verify account access and consider moving crypto holdings to self-custodied wallets until full breach scope and timeline are disclosed.
For Investors
The incident exposes operational risk at fintech platforms and likely prompts regulators to mandate stricter data-request verification standards across the sector.
For Builders
Platforms storing transaction and identity data should implement multi-factor verification and cryptographic request signing for government disclosures; non-custodial infrastructure eliminates this attack surface.
This article is for information only and is not financial advice. Read the full disclaimer.
