Revolut Handed Your Bitcoin Activity and Passport to a Fake Cop — Here's What Leaked
Revolut confirmed Saturday that it surrendered customer Bitcoin transaction records, passport scans, selfies, and home addresses to a fraudster who successfully impersonated a legitimate government authority.
No customer funds were taken. But in crypto, your financial fingerprint and your real-world identity are often worth more than the coins themselves.
What Actually Happened
The digital bank, which serves over 45 million customers globally and has aggressively expanded its crypto offerings, treated a fraudulent data request as if it came from a real government body. The result: sensitive personal and financial information walked out the door, handed over willingly by Revolut's own compliance process.
The company disclosed the breach publicly on Saturday, confirming that the exposed data included:
- Bitcoin transaction activity - Passport documents - Selfie verification photos - Home addresses
Think about that combination for a second. Someone now potentially holds a map of your crypto behavior, your face, your government ID, and where you sleep at night.
Why This Hits Different for Crypto Users
Traditional bank breaches are bad. But crypto users face a layered threat that bank customers don't. On-chain Bitcoin activity combined with a verified identity creates a target profile for SIM-swap attacks, phishing campaigns, and physical threats — sometimes called a "$5 wrench attack" in the security community.
Revolut's crypto user base is not small. The platform has been one of Europe's primary on-ramps for retail Bitcoin buyers. If your KYC data sat inside their system, this story is personal.
The fact that Revolut's own compliance team was fooled by a fake government request is the detail that should keep security professionals up at night. These so-called "emergency data requests" are a known attack vector, and they are becoming more sophisticated. Revolut is not the first company to fall for one — and it will not be the last.
What Crypto Holders Should Do Right Now
Revolut says no funds were lost, and they have since identified the request as fraudulent. But the data is already out.
If you hold crypto on Revolut or completed KYC verification through the platform, treat your personal security posture as compromised. That means:
- Rotate your email password and enable hardware-key 2FA immediately - Contact your mobile carrier and add a SIM-lock PIN - Watch for targeted phishing attempts referencing your real name or address - Consider moving significant holdings to a self-custody wallet
The market implication is broader than one breach. Regulators are already pushing for tighter KYC requirements across crypto platforms — incidents like this will accelerate that pressure. Watch for compliance-related headlines to weigh on fintech-adjacent crypto sentiment in the short term.
Your coins may be safe. Your identity is a different story.