Revolut Exposed User Data in Response to Fake Government Request

Revolut reportedly disclosed sensitive customer information after responding to a fraudulent government request. The incident potentially exposed identity documents, home addresses and financial records belonging to some users.

Onchain investigator ZachXBT disclosed the incident on Sept. 12. He said Revolut received a request that appeared to come from a legitimate government agency.

The request used the agency’s official email domain and passed domain authentication checks. Revolut later determined that the communication was unauthorized.

The number of affected customers remains unclear. ZachXBT said the incident appeared limited in scale and may have targeted high-net-worth users.

Revolut Shared Customers’ Home Address, Phone Numbers, and Financial Data

While it is unclear how many people were affected by the incident, ZachXBT believes it might be limited to the high-net-worth individuals.

More concerning is the broad scope of the information exposed. According to an email Revolut sent to affected users, sensitive and personally identifiable information was disclosed.

These include identity details such as full name, date of birth, and occupation. passport and/or driver’s license, the verification selfie, email address, and postal address were also included.

Revolut’s email also stated that its response included financial data such as account statements, IBANs, withdrawal records, and full transaction history, including Bitcoin transactions.

However, the neobank, which recently secured conditional approval for a bank charter from the US Office of the Comptroller of the Currency (OCC), stated in the email that users’ accounts remain secure.

Revolut has yet to release any public statement on the incident.

Impacted Users Criticize KYC as Risk of Wrench Attacks Increases

Meanwhile, some of the affected users have spoken out. Crypto entrepreneur and Aave Chan Initiative founder Marc Zeller confirmed he was affected.

He noted that Revolut had initially sent an email asking for several pieces of personal data and threatening to close his account within 20 days. Zeller now believes the fintech firm was acting on the fake government request at the time.

Unsurprisingly, he criticized KYC, noting that it “hasn’t produced meaningful upside and has put many in harm’s way.”

One of the major concerns for users affected by the incident is their increased risk of phishing attacks now that their personal information has been exposed.

Even riskier is the home address, which could make users targets for wrench attacks. These physical attacks on crypto users to steal their assets have become a major problem in recent years.

According to CertiK, the first half of 2026 saw 52 verified wrench attacks, with 33 occurring in France. French authorities actually reported a higher figure, with French interior minister Laurent Nuñez claiming there were 77 crypto-linked kidnapping and extortion cases in the first half of the year.

CertiK also stated that financial exposure from those attacks rose to $124 million, up from just $10.5 million in the first half of 2025. Interestingly, the firm highlighted major data breaches as one of the reasons behind the high concentration of attacks in France.