$BTC
Revolut was tricked by a fake government email into handing over customers’ passports and Bitcoin records
KYC data
which became a precise hunting list
Brothers
Just saw this news
I’m literally laughing with anger
Revolut
That UK fintech giant valued at tens of billions of dollars
was fooled by a fake government email
to hand over customers’ passports, selfies, home addresses,
including complete Bitcoin transaction records
This time it’s really outrageous—
outrageous enough to open the door
Revolut confirmed with some users
an urgent data request
that looked like it came from a government agency
was actually an unauthorized forged request
What’s even crazier is
this email address was created within the real government agency domain system
and it even passed email authentication checks like SPF, DKIM, and DMARC
So at the time, Revolut really treated it as a legitimate request from a government department
and directly provided some customer information
According to the information disclosed so far,
the data involved may include
name, date of birth, address, ID documents, identity verification photos, IBAN,
and transaction records including BTC
When I read this, I was completely stunned
In the past, when we fought scams,
we could at least say one thing—
check the email address
Now they make the email address look exactly real
This is especially troublesome for the crypto world
Because if identity information, KYC photos, bank account information, and BTC transaction records
are put together,
then scammers can carry out highly targeted phishing and social engineering attacks later,
甚至 even go after high-net-worth users
The difficulty becomes much lower
However, as of now there is no publicly disclosed evidence showing that users’ funds were directly stolen,
and details like the number of affected people and the specific government agency name have not been fully revealed
So the biggest warning for the crypto community from this is:
From now on, if you see the words “official email,”
don’t—seriously—believe it too much
#revolutconfirmsfakegovemaildatabreach
Revolut was tricked by a fake government email into handing over customers’ passports and Bitcoin records
KYC data
which became a precise hunting list
Brothers
Just saw this news
I’m literally laughing with anger
Revolut
That UK fintech giant valued at tens of billions of dollars
was fooled by a fake government email
to hand over customers’ passports, selfies, home addresses,
including complete Bitcoin transaction records
This time it’s really outrageous—
outrageous enough to open the door
Revolut confirmed with some users
an urgent data request
that looked like it came from a government agency
was actually an unauthorized forged request
What’s even crazier is
this email address was created within the real government agency domain system
and it even passed email authentication checks like SPF, DKIM, and DMARC
So at the time, Revolut really treated it as a legitimate request from a government department
and directly provided some customer information
According to the information disclosed so far,
the data involved may include
name, date of birth, address, ID documents, identity verification photos, IBAN,
and transaction records including BTC
When I read this, I was completely stunned
In the past, when we fought scams,
we could at least say one thing—
check the email address
Now they make the email address look exactly real
This is especially troublesome for the crypto world
Because if identity information, KYC photos, bank account information, and BTC transaction records
are put together,
then scammers can carry out highly targeted phishing and social engineering attacks later,
甚至 even go after high-net-worth users
The difficulty becomes much lower
However, as of now there is no publicly disclosed evidence showing that users’ funds were directly stolen,
and details like the number of affected people and the specific government agency name have not been fully revealed
So the biggest warning for the crypto community from this is:
From now on, if you see the words “official email,”
don’t—seriously—believe it too much
#revolutconfirmsfakegovemaildatabreach
