Revolut Exposes Passports and Bitcoin Histories to Fraudulent Government Request

According to crypto investigator ZachXBT, Revolut disclosed sensitive customer data including passport copies, verification selfies and full Bitcoin transaction histories after fulfilling a fraudulent request sent from a government agency email domain on September 12, 2026.

The malicious actor used a legitimate government domain with valid domain authentication credentials, prompting Revolut to comply believing the request was genuine. Exposed data included full names, dates of birth, contact information, identity documents and account statements with Bitcoin transaction records. A Revolut spokesperson confirmed it was "a sophisticated external impersonation scam," stating a "limited" number of customers were affected and that systems and funds remained unaffected. ZachXBT noted the breach appeared to target high-net-worth users, raising concerns amid a wave of violent "wrench attacks" against crypto holders.