Revolut Confirms Passport, Bitcoin Transaction Leak From Fake Gov’t Request

Revolut has confirmed that passports, identity-verification selfies, and full crypto transaction histories, including Bitcoin activity, were handed to a fraudster who used a spoofed government agency email address to request the data. The request passed Revolut’s authentication checks before the company determined it was fake. Affected customers were notified on Friday.

What two independent sources confirm: the exposed data included passports, verification selfies, and transaction histories; the request came from what appeared to be a legitimate government domain; Revolut later ruled it inauthentic; and only a “limited” number of accounts were affected. Onchain investigator ZachXBT’s view, that the leak looked narrow in scope and aimed at high-net-worth users, is also cited by two outlets, though it remains his characterization rather than a Revolut-confirmed figure.

How a Government Domain Beat Revolut’s Own Checks

The mechanism behind the incident is what makes it notable. Revolut did not suffer a hack of its own systems. Instead, an unauthorised party impersonated a government agency and emailed Revolut from that agency’s own domain, requesting customer information under what looked like a routine, legally backed data request.

A Revolut spokesperson described it to Cointelegraph as “a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.” Because the domain itself was genuine, the request cleared Revolut’s authentication layer before internal review flagged it as fraudulent.

Once identified, Revolut said it blocked the sender’s address, alerted the government agency whose domain was spoofed, and notified law enforcement and financial regulators. The company maintains that its own systems and customer funds were not affected, and that the leak was limited to information handed over in response to the fraudulent request rather than a broader breach of its infrastructure.

What Remains Single-Sourced

Not every detail circulating about the incident carries the same weight. The claim that Revolut’s authentication process was first flagged publicly via a post from International Cyber Digest on X traces back to a single account, not to Revolut’s own disclosure. Similarly, commentary from Aave contributor Marc Zeller, who said he woke up to find his data included in the leak and argued that mandatory KYC “has put many in harm’s way,” appears in only one of the three reports reviewed here and should be treated as one user’s account rather than a confirmed detail of the breach’s scope.

ZachXBT’s assessment that the incident targeted high-net-worth users specifically is repeated across two outlets, which gives it more weight than a single-source claim, but it is still framed by both as speculation from an outside investigator rather than something Revolut itself has stated. Revolut has not published a count of affected users or a breakdown of how many held crypto accounts versus standard banking products.

Why the Domain Trick Matters for Crypto Users

Exchanges and neobanks routinely honor law enforcement and regulatory data requests as part of standard KYC compliance. This incident shows that the authentication step for those requests can be beaten if an attacker gains access to, or spoofs, a genuine government mail server, rather than needing to breach the financial firm directly.

For holders whose transaction histories sit inside custodial platforms like Revolut, the exposure risk is not limited to price or wallet security. It extends to the verification chain a regulated platform trusts by default. Revolut has not said whether it plans to change how it validates inbound government data requests going forward.

Sources

• cointelegraph.com
• theblock.co
• decrypt.co