In early 2024 a shadowy cyber‑crime group announced that it had compromised the data of millions of Revolut users, the popular UK‑based financial‑technology platform that offers banking, payments and cryptocurrency services. The group posted a public demand for a ransom of three million US dollars, to be paid in the privacy‑focused cryptocurrency Monero (XMR).
In addition to the monetary demand, the attackers threatened to put the stolen personal and financial information up for sale on underground markets if their deadline was not met. The leak was first reported when the hackers posted a message on a well‑known dark‑web forum, attaching a sample of the data they claimed to have exfiltrated.
The sample included email addresses, phone numbers, partial passport numbers, and, most notably, details of users’ crypto‑wallet balances held within Revolut’s own crypto service. The group emphasized that they were targeting accounts with “significant crypto holdings,” suggesting that they had filtered the data set to focus on high‑value victims who might be more willing to pay a ransom to prevent exposure. Revolut’s official response was swift but measured. In a statement released to the press, the company said it had become aware of the alleged breach and was working with law‑enforcement agencies and independent security experts to investigate the incident.
The firm also clarified that it had not received any direct contact from the attackers, meaning the demand was communicated through public channels rather than a private negotiation. Revolut reiterated that it had not observed any unauthorized transactions on its platform and that customers’ funds remained safe.
Cyber‑security analysts note that the use of Monero for the ransom is a strategic choice. Unlike Bitcoin, which is pseudonymous but traceable, Monero employs advanced cryptographic techniques that obscure transaction amounts, sender, and receiver, making it extremely difficult for investigators to follow the money trail. This anonymity makes Monero a favorite among ransomware operators who want to minimize the risk of detection. The threat to sell the stolen data adds another layer of pressure.
Personal data breaches have become a lucrative side‑business for many criminal groups. Once a data set is posted on a dark‑web marketplace, it can be bought by other threat actors who may use it for identity theft, phishing campaigns, or further extortion. For a financial‑services provider like Revolut, the exposure of user identifiers combined with crypto‑wallet information could enable sophisticated social‑engineering attacks that bypass traditional security controls. Experts advise users who hold cryptocurrency on Revolut to take several precautionary steps.
First, enable two‑factor authentication (2FA) on the Revolut app, preferably using an authenticator app rather than SMS, which can be vulnerable to SIM‑swap attacks. Second, consider moving large crypto balances to a hardware wallet where the private keys are stored offline, reducing reliance on a third‑party custodial service.
Third, monitor email accounts for suspicious login attempts or phishing messages that reference the breach, as attackers often follow up with targeted scams. From a regulatory perspective, the incident raises questions about data‑protection compliance. The UK’s Information Commissioner's Office (ICO) requires firms to report personal data breaches that are likely to result in a risk to individuals’ rights and freedoms. If the breach is confirmed, Revolut could face significant fines under the General Data Protection Regulation (GDPR) framework, in addition to reputational damage.
The broader fintech industry is watching closely. Revolut is not the first platform to experience a crypto‑related breach; similar incidents have hit other digital‑banking services that offer crypto trading, highlighting the growing attack surface as traditional banking merges with decentralized finance (DeFi). As more consumers store digital assets with fintech apps, the incentive for cyber‑criminals to target these repositories intensifies. Law‑enforcement agencies, including Europol’s European Cybercrime Centre (EC3), have issued warnings about the rise of ransomware groups demanding payment in privacy coins.
They stress that paying a ransom does not guarantee that data will be deleted or that the attackers will not release it later. Moreover, paying can fund further criminal activity and may be illegal in certain jurisdictions. In the weeks following the announcement, cybersecurity firms have begun scanning dark‑web forums for any signs that the Revolut data has already been listed for sale.
Early indicators suggest that the data is being packaged in bundles based on the value of the crypto holdings, with higher‑value accounts priced at a premium. This tiered pricing model reflects a sophisticated monetisation strategy that leverages both ransom and data‑sale revenue streams.
For Revolut’s customers, the immediate concern is the potential for phishing attacks that reference the breach. Attackers may craft emails that appear to come from Revolut’s security team, urging users to verify their accounts or reset passwords using malicious links. Users should verify any communication by checking the official Revolut website or contacting support through the app, rather than clicking on unsolicited links. In summary, the group behind the Revolut data breach is leveraging a combination of ransom demand in Monero and the threat of public data exposure to pressure the company into paying $3 million.
While Revolut asserts that it has not been directly contacted and that user funds remain secure, the incident underscores the vulnerabilities inherent in the convergence of traditional finance and cryptocurrency services. Customers are advised to strengthen their security posture, consider moving large crypto balances to self‑custody solutions, and remain vigilant for phishing attempts. Meanwhile, regulators and law‑enforcement agencies will likely scrutinize the case closely, potentially setting new precedents for how fintech firms must protect user data in an increasingly hostile cyber environment.