Revolut Suspected of Leaking High-Net-Worth Information Due to Forged Official Letter
On-chain investigator ZachXBT stated on his personal channel that Revolut allegedly failed to identify a fraudulent request, leading to the leakage of some users' personal identity information. The request was described as seemingly coming from a legitimate government agency, sent via the agency's official email domain, and accompanied by valid domain authentication, prompting the company to respond. Multiple users received security incident notifications the previous day. The company officially reminded users to verify suspicious information through in-app customer service; the notification also stated that biometric facial telemetry data had not been leaked.
According to the report, the materials that may have been accessed include copies of passports or driver's licenses along with verification selfies, account statements, IBANs, withdrawal records, complete transaction histories including Bitcoin transactions, as well as names, birth dates, occupations, home addresses, emails, and phone numbers. The scale is said to be potentially limited, but the profile points to high-net-worth clients. The investigator is known for tracking crypto theft and fraud, and this report was made through a channel rather than an exchange announcement.
This is not the same incident as another set of rumors earlier this year. In July, hackers claimed to sell about 75 million Revolut records, with samples including some card numbers, emails, phone numbers, and hashed credentials; Cybernews was unable to verify the volume, and the company stated at the time that there were no signs of a breach, claiming that the users in the sample did not match real system card identifiers. The core of this report is not about dark web sales, but rather that a compliance channel was accessed through a forged official letter with domain authentication.
For high-net-worth cryptocurrency users, a passport plus a selfie plus complete on-chain withdrawal records constitute a composite identity package: sufficient to support targeted phishing, account impersonation, and extortion tactics. The IBAN and account statements tie fiat currency transactions and Bitcoin inflows and outflows to the same individual. The fact that facial telemetry data has not been leaked only narrows the layer of live detection that can be directly copied, and does not reduce the risk of secondary use of document copies.
The market mechanism is that compliance requests are occupied by forged requests. Buyers are targeted attackers who need complete KYC files; sellers are not dark web stalls, but government letters that financial institutions must respond to. Funds have not yet manifested as a statistically significant total of stolen coins, but rather as preparations for subsequent fraud and account takeovers. Beneficiaries are investigators and monitoring firms that can frame the incident as a security product case; the pressured party is the licensed electronic bank that must determine the authenticity of the letter within anti-money laundering request deadlines. The event is driven by the investigator's channel and user emails, and the company has not yet issued a corresponding detailed incident report.
Domain authentication does not equal that the sender is the government. Once high-net-worth profiles are sent out as a complete package via official letters, the loss does not occur from a server breach, but from being deceived during the approval process.
Source: Public Information
ABAB AI Insight
ZachXBT has shifted the battleground from on-chain mixers to email gateways. Revolut's moat is its European electronic money license and KYC repository; attackers did not breach databases but turned the legitimate exit of the repository—government requests—into a one-time channel. The high-net-worth filtering indicates that the target is not the email list of 750,000 ordinary users, but a small number of accounts that simultaneously possess passport images and Bitcoin transaction histories. After the company denied the previous "tens of millions for sale" incident in July, this time the user notification email confirms that at least a small group of individuals has been specifically named.
The capital path is the backlash of compliance costs. Electronic banks must retain documents, selfies, and complete transaction histories to pass regulatory scrutiny; the same set of files becomes available in the face of forged official letters. Money will not immediately disappear from Revolut's treasury but will leave users in the coming weeks in the form of phishing transfers, fake customer service, and account impersonation. If the company pursues write-offs and credit monitoring, the costs will go into operations; if regulatory authorities determine that there was negligence in the request review, fines will impact capital. The investigator's channel serves as a faster disclosure layer than the official.
The analogy is the bank's verification of documents after law enforcement agency emails are spoofed, and password resets after SIM card swaps. The difference this time is that the authentication record shows that the domain check passed, with the failure point being that personnel or processes did not double-check the official letter number. The industry phase is controlling the request interface: whoever can demand that financial institutions submit KYC within deadlines can take the highest value identity package without breaching core databases.
The structural change is a shift in attack surfaces driven by regulatory changes. The mechanism is that anti-money laundering obligations create necessary response exits, and authenticated emails disguise the exit as official. On-chain transparency allows Bitcoin transaction histories to be matched with passport names, making high-net-worth individuals more valuable for a well-crafted official letter than ordinary users. The security boundary has shifted from firewalls to legal email accounts.
ABAB News · Cognitive Laws
The hardest files are often taken from legitimate windows.
A passport plus on-chain transaction history is more suitable for targeted harvesting than a password.
Authenticated emails do not equal that the sender is the government.