Revolut Says a Fake Government Request Exposed Customer KYC and Bitcoin Data

Revolut has disclosed that customer identity verification records and Bitcoin transaction data were handed over in response to a data request that appeared to come from a government domain — and later turned out to be fraudulent, according to reporting from The Block.

No password was stolen. No customer clicked a bad link. As far as the reporting describes, Revolut's own systems were not broken into. The company received what looked like an official request from an authority, checked it against whatever process it had, and complied.

That is the part worth sitting with. The weak point was not a firewall. It was a procedure.

You can read our news summary of the incident here. The rest of this piece is about the mechanism — because this category of attack is older than crypto, it will still exist in five years, and understanding it changes how you think about every account you have ever verified your identity with.

First, what actually got exposed

Two distinct things, and they are worse together than apart.

KYC data. KYC stands for "Know Your Customer." It is the process where a financial company asks you to prove who you are before letting you open an account — usually a passport or driver's licence photo, a selfie, a home address, a date of birth, sometimes a utility bill. Banks have done this for decades. Crypto exchanges and fintech apps do it because the same regulations apply to them.

Bitcoin transaction records. Bitcoin is the original cryptocurrency, launched in 2009, running on a public network of computers rather than through a bank. Its ledger is public by design: anyone can look up any address and see every payment in and out of it. What the public ledger does not show is who owns an address.

That is the hinge. The blockchain is a phone book with numbers but no names. KYC data is the names. A company like Revolut holds both halves at once — it knows that this passport belongs to this person, and that this person sent Bitcoin to that address on that date.

When those two datasets leave the building together, someone outside now has the pairing. And here is the property that makes it permanent: you can change a password, freeze a card, and get a new account number. You cannot change the fact that a specific Bitcoin address received funds on a specific date, because that record lives on a public ledger forever. If a name has been attached to it, the attachment does not expire.

The attack: a request, not a break-in

The technique described in the reporting is sometimes called an emergency data request scam, and it has been used against large technology companies before.

The shape of it is simple. Companies that hold user data receive requests from law enforcement and government agencies. Normally there is a legal process — a warrant, a subpoena, a formal order that the company's legal team reviews. But there is also a faster lane for genuine emergencies, where waiting for paperwork could mean someone gets hurt. A request arrives claiming urgency, it comes from what looks like an official government email address, and the company decides to comply first and verify later.

An attacker who can send mail from a government domain — by compromising a real account or by spoofing the domain — can walk straight into that fast lane. The Block's reporting notes it is not yet clear which of those two happened in Revolut's case.

Notice what is being exploited. Not a cryptographic flaw. Not an unpatched server. The thing being exploited is trust in a channel. The company trusts that mail from a government domain is from the government. That assumption is doing all the security work, and it is a weak assumption.

The most expensive breaches are often not technical. They are a person following a reasonable-looking process, correctly, on a fraudulent input.

This is why "was the company hacked?" is sometimes the wrong question. In this case, per the reporting, the intrusion — if there was one — happened on the government side of the exchange, and Revolut's role was to comply with what reached it. The data still left. The outcome for an affected customer is the same either way.

Why this is not just an identity-theft story

Exposed identity documents are bad in the familiar way. A passport scan plus an address plus a date of birth is a starter kit for opening accounts in someone else's name.

The crypto angle adds something else: the loss of pseudonymity is one-directional.

Bitcoin is often described as anonymous. It is not. It is pseudonymous — your activity is tied to an address rather than a name, and the address is public. Privacy in Bitcoin comes entirely from the gap between the address and the human. Every time you complete KYC at a company and then move Bitcoin, you hand one institution the ability to close that gap.

That is not a reason to avoid regulated companies; it is simply what the trade looks like. Governments have clear and stated reasons for wanting this linkage — tax enforcement, sanctions, anti-money-laundering rules — and we cover that reasoning in the lesson Why Governments Care About Crypto. The point is that the linkage, once created, is a permanent asset sitting on someone else's server. Its safety depends on their procedures, not yours.

If you want to understand the asset that sits underneath all of this, our Bitcoin overview covers the basics of how the network and its public ledger work.

What this teaches that outlives the headline

Four things generalise well beyond one company.

1. Your data footprint is larger than your accounts. Most people picture their exposure as "my exchange login." The real surface is every organisation that has ever verified your identity, plus every organisation those entities are legally obliged to answer to, plus anyone who can convincingly impersonate the latter. You have no visibility into most of it.

2. Data you gave away years ago is still live. Closing an account does not usually delete your KYC file. Retention periods under anti-money-laundering rules typically run for years after a relationship ends, because the whole point of the record is to be available to investigators later. An exchange you abandoned in 2019 may still hold your passport scan.

3. Authority is the strongest social-engineering lever there is. The Revolut case is the institutional version of a scam that also runs against individuals every day: someone claiming to be the tax office, the police, or your bank's fraud department, using urgency to skip the verification step. If a large regulated fintech can be moved by a convincing official request, a person on the phone at 9pm can too. The defence is identical at both scales — verify through a channel you chose, not the one the request arrived on. Hang up and call the number on the back of your card. Do not reply to the email.

4. On-chain history is a permanent record, and it can be read backwards. Blockchain analysis firms do this professionally: they cluster addresses, follow flows between them, and build a picture of who controls what. One confirmed name-to-address link can seed a much wider map, because from that address the public ledger reveals every counterparty it ever touched. This is a structural property of a transparent ledger, not a bug someone will patch.

Practical questions to ask, not instructions to follow

We do not tell readers what to do with their money, and we are not going to start here. But there are questions you can ask yourself, and the answers are yours.

• Which companies currently hold a scan of my government ID? Can I list them from memory?
• Do those accounts have two-factor authentication that is not SMS? (SMS codes can be intercepted through SIM-swap attacks, where an attacker convinces a mobile carrier to move your number to their device — another social-engineering attack on a company's procedures, not on you.)
• If a breach notification arrived tomorrow naming one of them, what would I actually do in the first hour?
• Do I understand what my exchange's policy is for responding to government data requests, and is it published anywhere?
• Am I reusing an email address across financial accounts in a way that links them together for anyone who obtains one list?

That last one matters more than people expect. Correlation is how investigators and attackers both work. A single shared email or phone number can stitch together accounts that you thought of as separate.

The uncomfortable summary

The scope of this incident is not fully public. The reporting does not yet detail how many customers were affected, which jurisdictions were involved, which specific documents were disclosed, or how customers have been notified. Those details matter and may change the picture.

What does not depend on the details is the lesson. Every regulated financial product involves handing your identity to a third party and trusting their internal process to protect it. That is not a flaw in crypto specifically — it is how the regulated financial system is built, and it applies to your bank exactly as much as to your exchange.

Crypto just makes the consequence more visible, because the ledger on the other side of the link never forgets.

Understanding that trade-off clearly — what you gain in convenience and legal protection, what you give up in privacy, and who else has to do their job properly for that bargain to hold — is not paranoia. It is literacy.