Revolut: Bitcoin History and IDs Exposed After Fake Request

Revolut has confirmed a customer data exposure in which identity documents and, according to reviewed customer notices, Bitcoin transaction histories were handed to an unauthorized third party after fraudulent information requests were sent using a legitimate government agency email domain. The incident underscores a recurring tension for Bitcoin holders: exchanges and neobanks retain detailed records that link a person's identity to their on-chain financial activity. WHAT TO KNOW Revolut confirmed that identity and contact details, with financial records reportedly including Bitcoin activity, were released to a third party posing as a government requester. The exact number of affected customers, the impersonated agency, the affected markets and the precise date of the fraudulent disclosure remain undisclosed. What the Revolut Bitcoin Data Exposure Claim Says Revolut confirmed that an unauthorized third party obtained sensitive customer information through fraudulent requests sent from a legitimate government agency email domain, a company spokesperson told TechCrunch, which reviewed the notification sent to affected customers. For related coverage, see Revolut Says KYC, Bitcoin Data Exposed After Fake Request. The notice listed identity and contact details, including birth dates, postal and email addresses, telephone numbers, and copies of passports or driver's licenses among the exposed data. Revolut's notification also said verification selfies, account statements and transaction histories may have been included, language that stops short of confirming every field for every affected customer. For related coverage, see Revolut Discloses Bitcoin Histories After Fake Govt Request. Decrypt, reviewing the same customer notice, reported that the exposed financial records described IBAN and wallet reference numbers, withdrawal records and full transaction histories including Bitcoin. That detailed Bitcoin scope is attributed to the reported notice rather than to any independent forensic finding, and the individual scope of what each customer lost is unknown. For related coverage, see Revolut Exposes Bitcoin Activity in Fake Request Incident. The affected-customer count, the incident date and the jurisdictions involved are not established in the available reporting. The parallel accounts collected in coverage of how Revolut said KYC and Bitcoin data were exposed after the fake request agree on the categories of information without resolving the numbers, and readers should treat the precise scope as open. For related coverage, see Revolut Leak Claim Links Bitcoin Wallets to Home Addresses. Questions About the Alleged Fake Government Request The sequence reported so far, a fraudulent request followed by a disclosure, is a chronology, not a verified technical explanation of how the release was authorized. A legitimate government email domain does not by itself demonstrate a valid legal demand, and the specific legal basis and request-validation process behind this disclosure are unknown. For related coverage, see Hackers Reportedly Obtained Revolut Passports, Bitcoin Data.