USD
Revolut Data Breach Leads to 6,000 XMR Extortion Demand
Attackers Say Crypto-Heavy Customers Were Targeted Through Fraudulent Government Requests
TL;DR
- Attackers calling themselves Iamnotavillain demanded 6,000 XMR, worth roughly $3 million, after claiming to have data on about 680 Revolut customers.
- Revolut said its core systems and customer funds were not compromised, describing the incident as a “sophisticated external impersonation scam.”
- The attackers claimed they used a legitimate Italian government email channel to request customer records.
- Crypto-heavy customers were allegedly targeted using blockchain analysis, increasing concerns about identity theft and physical attacks.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Attackers claiming responsibility for a Revolut customer-data incident demanded 6,000 Monero, valued at roughly $3 million, after saying they obtained information on about 680 customers.
Revolut said its core systems were not breached and customer funds were not compromised. Instead, the company said an unauthorized party submitted fraudulent information requests using an email account associated with a legitimate government agency.
Revolut described the incident as a “sophisticated external impersonation scam.”
Attackers Allegedly Posed as Italian Officials
The group, calling itself Iamnotavillain, told Financial Times reporters that it posed as Italian law-enforcement officials for months.
The attackers claimed Revolut responded to requests for specific customers, allowing them to collect information including:
- Names and home addresses
- Dates of birth and phone numbers
- Passport and driver's-license copies
- Verification selfies and KYC records
- Account IDs and IBANs
- Bank statements
- Fiat transfers
- Crypto deposits and withdrawals
- Transaction histories
Revolut confirmed that fraudulent requests came through an email account linked to a legitimate government-agency domain but did not confirm the attackers' claim that they had hacked an Italian government email system.
The requests allegedly used Italy's Posta Elettronica Certificata, or PEC, certified-email system.
Valid domain credentials could show that messages originated from the government domain without proving that the person operating the account was an authorized official.
Crypto Users Were Allegedly Targeted
Iamnotavillain said the victims were deliberately selected.
The group claimed it used blockchain analysis to identify Revolut customers with substantial cryptocurrency activity before requesting their records by name.
Reporting placed affected customers across 31 countries, with many in Switzerland and France.
Onchain investigator ZachXBT said:
“While the incident is likely limited in size it seems to have been targeted at high net worth users.”
Former Mt. Gox executive Mark Karpelès also said he was affected and shared a Revolut notification indicating that information involving Bitcoin transactions had been disclosed.
Revolut characterized the number of affected customers as “limited” and did not confirm the attackers' estimate of roughly 680 files.
Attackers Demand 6,000 XMR
Revolut disclosed the impersonation incident on September 12, 2026, saying it had blocked the fraudulent channel and notified the relevant government agency, regulators and law enforcement.
On September 16, Iamnotavillain posted a public ultimatum demanding 6,000 XMR and giving Revolut 24 hours to respond.
The group threatened to sell the customer records to other criminals if payment was not made.
Reuters reported that Revolut had received no direct ransom demand or communication from the attackers at the time of its reporting.
An earlier 10,000 BTC demand circulated through Telegram, but Iamnotavillain later said it came from an impersonator or former associate.
Leaked KYC Data Raises Physical-Security Risks
The incident presents particular risks for crypto users because leaked identity information can potentially connect blockchain activity with real names and physical addresses.
Chainalysis said violent crypto crimes are often premeditated, with victims potentially identified through leaked databases, social media, blockchain analysis or insider information.
The firm estimated that more than $30 million had been stolen in violent “wrench attacks” by mid-2026, while noting that many incidents likely go unreported.
CertiK data showed 52 verified physical crypto attacks during the first half of 2026, including 33 in France. Home invasions rose from one case in H1 2025 to 20 in H1 2026.
Revolut Incident Highlights Authentication Risk
Revolut said the incident did not involve penetration of its core banking infrastructure.
Instead, it exposed a different security weakness: attackers allegedly exploited a trusted channel used for official information requests.
For centralized financial platforms holding extensive KYC and transaction records, that distinction matters.
The incident showed that sensitive crypto customer data can be exposed without hackers directly breaching a company's core systems if attackers successfully impersonate trusted authorities and bypass the processes used to authenticate official requests.
