Revolut: Some users' KYC and Bitcoin transaction data may have been leaked, but the system and funds were not affected

Revolut disclosed that an unauthorized third party used a legitimate email address under a government agency's real domain to submit false customer data retrieval requests, resulting in the disclosure of sensitive information for a small number of customers. The company referred to the incident as a "complex external impersonation scam," and has since banned the related email address, stating that its systems and customer funds were not affected.

The potentially disclosed information includes names, dates of birth, addresses, email addresses, phone numbers, copies of identification documents such as passports and driver's licenses, identity verification selfies, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin transaction records. Former Mt. Gox CEO Mark Karpelès stated that he is one of the affected individuals. Revolut has not disclosed the number of affected customers, whether the incident involved only a single market, or the government agency to which the impersonated domain belongs. The company has notified relevant government agencies, law enforcement, data protection authorities, and financial regulatory bodies. On-chain investigator ZachXBT speculated that the scale of the incident may be limited, but the target may be high-net-worth users.