A fake government email slipped through security controls at Revolut this week, exposing residential addresses, identity documents and Bitcoin transaction histories belonging to a group of customers.
The request appeared to come from a legitimate government agency and carried credentials that passed Revolut's checks. The company handed over customer information before separately contacting the agency and discovering the request was fraudulent, according to notices sent to affected users.
The files reportedly included passports or driving licences, verification selfies, names, dates of birth, occupations, home addresses, emails, phone numbers, IBANs, account statements, withdrawal records and full transaction histories, including all Bitcoin activity.
Revolut has not disclosed how many customers were affected and did not immediately respond to a CoinDesk request for comment. It said in its notification that customer funds remained safe, and has notified affected users and regulators while blocking the source of the request.
The Failure Was Authorization, Not Encryption
No system was breached in the conventional sense.
Once the request cleared Revolut's internal checks, someone posing as a government official gained access to the same deeply personal information the bank had collected to satisfy identity and compliance requirements.
That distinction matters for anyone assessing their own exposure elsewhere. Encryption, cold storage and access logging address a different threat model entirely. A process that legitimately releases data to verified requesters fails when the verification itself is the target.
Financial institutions field government data requests routinely, and the volume creates pressure toward efficient handling. An attacker only needs the credential check to pass once.
AI Makes This Category of Attack Cheaper at Scale
Convincing emails, documents, identities and bureaucratic requests are becoming inexpensive to produce in volume, while financial companies continue holding increasingly detailed records about who their customers are, where they live and how they move money.
That combination changes the economics. Impersonating a government agency convincingly once required specific knowledge of agency formatting, reference structures and language conventions. Those are now reproducible from public examples at near-zero marginal cost.
The defensive burden rises correspondingly. Every institution holding sensitive data must now verify inbound authority against a threat that can generate unlimited plausible attempts.
The Combination of Data Is the Specific Risk
Bitcoin makes the exposure unusually concrete.
The blockchain records transactions publicly. Personal details — passport, home address, occupation — sit outside the network. Financial intermediaries connect those two sets, turning a customer database into a map linking a real person to their onchain activity.
Onchain investigator ZachXBT, who drew attention to the incident, said in a Telegram broadcast that the breach appeared limited in size and may have targeted high-net-worth users.
If that assessment is correct, the selection pattern matters more than the volume. A targeted request for specific high-balance accounts produces a materially different risk profile than a bulk extraction, because it suggests the requester already knew what they were looking for.
Affected customers face immediate follow-on risk from phishing that uses the exposed details to appear credible — a caller who knows your address, account balance and recent transactions is considerably harder to dismiss. Anyone notified should treat unsolicited contact referencing their Revolut account with particular caution and verify independently through official channels.
Those with significant holdings should also consider their physical security posture, given that address and balance information appeared together.
Zero-Knowledge Proofs Gain a Concrete Use Case
The incident gives privacy technology an immediate application rather than a theoretical one.
Zero-knowledge systems allow someone to prove an identity check was completed, or that a customer satisfies a particular requirement, while revealing less of the passport, address or underlying information used to establish it.
The architectural difference is what matters here. Under current arrangements, satisfying a compliance requirement means the institution holds the underlying documents indefinitely, and any subsequent failure exposes all of it. Under a proof-based system, the institution holds an attestation rather than the source material.
An attacker who successfully impersonates a government agency against a ZK-based system receives confirmation that checks were passed. They do not receive a passport scan and a home address.
The Question Is Shifting From Protection to Collection
As impersonation becomes easier, the security problem moves from how well institutions protect customer data to how much sensitive information they need to collect, retain and reveal at all.
That reframing has regulatory implications the compliance regime has not addressed. Know-your-customer requirements were designed around a threat model where the institution was the trusted holder and the risk was external intrusion. They do not account for the institution being socially engineered into voluntary disclosure.
Every additional field a regulated entity is required to collect expands the dataset available in a failure of this type. The compliance framework and the security outcome are working against each other, and the Revolut incident is a demonstration rather than an argument.