UK digital banking giant Revolut admitted on September 12 that an email disguised as a government agency bypassed its internal verification process, resulting in some customers’ identity documents and complete Bitcoin transaction records being handed over to scammers.
According to user notification emails obtained from CoinDesk, this email appeared on the evening of Friday, September 11. The sender impersonated a legitimate government agency, and all attached credentials and files passed Revolut’s internal checks.
And the leaked list included:
A passport or driver’s license, as well as the selfie photo used for KYC.
Name, date of birth, occupation, residential address, email, and phone number
IBAN, account details, and withdrawal records
Complete transaction records, including all activity involving Bitcoin
Additional explanation: KYC is the legally required process by which a financial institution verifies your identity when you open an account. When you register for an exchange, you upload the front and back of your ID card, and then take a selfie holding your ID—what you do is exactly that.
And this time, the problem lies in the order of the process. Revolut first handed over customer data, and only then reached out to the authorities—only to find that the request didn’t even exist.
After-the-fact, Revolut stated that the customer’s funds are currently safe. The company has already blocked the source and has notified affected users and the relevant authorities. As for how many people in total were affected, no figure has been released so far.
What’s worth noting about this incident is that the database was not breached, and the firewall was not compromised—yet the data still leaked out. The scammer doesn’t need to break into anything. They only need to get the system to believe that “this request comes from a legitimate government agency,” and then the data will be automatically “authorized” and sent out as required.
On Telegram, on-chain investigator ZachXBT pointed out that while this operation isn’t large in scale, it may be specifically targeting high-net-worth users. He emphasized that such leaks directly “de-anonymize” Bitcoin users who were originally anonymous on-chain. The risks aren’t only privacy— they also extend to both property and personal safety.
Because a Bitcoin address is just a string of characters—no one knows who that string belongs to, and no one knows where he lives. But if someone obtains together the person’s name, residential address, and all of that person’s Bitcoin transaction records, once these pieces are combined, their holdings, trading habits, and roughly how much money they have are all laid bare.
Based on my observations, what is truly worth Taiwanese readers remembering about this isn’t whether Revolut’s process had a flaw—it’s the “KYC” that binds our identities to our encrypted assets.
In Taiwan, from the day you opened an account on the exchange, after you uploaded your ID card and selfie, every deposit/withdrawal and trade—each one—has been laid out in the open.
As for what these information can actually achieve, Taiwan’s law enforcement has already demonstrated that. During Taiwan’s 2024 presidential election period, within two months, law enforcement arrested more than 30 gamblers who had placed bets via overseas prediction platforms (Polymarket). The total amount bet was approximately NT$46 million. Their method was to first trace the funds flow on-chain, then use those wallet addresses to cross-check against the exchange’s real-name authentication data.
So I believe the sense of security gained from KYC might only be “one-way.” It protects the platform’s legal responsibilities, but whether your personal privacy—once handed over—can be kept safely and who controls it is never really in your hands.
If someone were able to get your ID card, your residential address, and every record in your wallet at the same time—what would you think?
Feel free to share with me~
⚠️ The content above is for reference only and does not constitute any investment advice.