Revolut has confirmed that it mistakenly disclosed sensitive customer information to an unauthorized party following a sophisticated phishing attack. Multiple media outlets reported over the weekend that the digital banking platform shared client records with outsiders who posed as officials using an email address hosted on a legitimate government agency’s domain. A company spokesperson explained that Revolut blocked the suspicious address immediately after discovering the scam and described the incident as an advanced impersonation effort targeting its clients.
Nature of the Compromised Information
Notifications circulated among users indicate that the compromised data includes personal details such as full names, dates of birth, home and email addresses, phone numbers, and scans of identification documents like passports and driver’s licenses. Reports also suggest that verification selfies, account statements, transaction records, and information related to cryptocurrency holdings such as Bitcoin were exposed.
Mark Karpelès, former CEO of Mt. Gox, publicly stated that he received a notice of impact, confirming the breach’s reach among prominent individuals in the cryptocurrency sector.
Notifications sent to affected users list names, dates of birth, contact details, and even copies of identification documents among the disclosed information.
Targeted Users and Company Response
ZachXBT, an independent blockchain investigator, alerted his followers to the breach and suggested that the attackers focused primarily on high-net-worth clients. However, Revolut has yet to disclose the total number of impacted users or to specify the public agency whose domain was leveraged in the fraudulent request.
The phishing incident has intensified ongoing concerns about the rise in “wrench attacks,” a term used for physically coercive or targeted scams aimed at gaining access to crypto assets.
Mini dictionary: Wrench attack, a security term used in the cryptocurrency world for attacks where criminals use threats or physical force to extract sensitive information such as passwords, as opposed to traditional hacking methods relying purely on software vulnerabilities.
Similar Incidents in the Industry
A similar breach was announced last week by hardware wallet provider Trezor, which revealed that attackers infiltrated its email provider and sent phishing messages from its legitimate domain. This incident followed another breach linked to ShipMonk, where data from 67,000 clients in the United States was reportedly exposed.
Revolut, a London-based neobank founded in 2015, serves more than 80 million customers worldwide. Earlier this month, the U.S. Office of the Comptroller of the Currency conditionally approved Revolut’s application to establish a national bank. In recent months, Revolut began offering its euro stablecoin, EURR, in Denmark, Poland, and Portugal, and is reportedly considering a public listing that could give the company a valuation up to $200 billion.
| Company | Incident Type | Impact |
|---|---|---|
| Revolut | Phishing via government domain | Sensitive customer data exposed |
| Trezor | Email provider breach | Phishing messages sent, US user data compromised |
| ShipMonk | Logistics breach | 67,000 US users affected |
Security experts in the cryptocurrency sector continue to urge increased awareness and enhanced protocols as digital asset holders remain a popular target for sophisticated attacks.
