In early 2024 a cyber‑crime collective that has previously claimed responsibility for several high‑profile data leaks resurfaced with a new extortion campaign aimed at Revolut, the UK‑based financial‑technology firm that offers banking, currency exchange and cryptocurrency services to millions of customers worldwide. The group announced that it had exfiltrated a substantial amount of personal and financial data belonging to Revolut users, and it demanded a ransom of three million US dollars, to be paid in Monero, a privacy‑focused cryptocurrency that makes tracing transactions extremely difficult. The attackers set a strict 24‑hour deadline for the payment and warned that, should the demand be ignored, they would begin selling the stolen information on underground markets. The threat was broadcast through a series of posts on a dark‑web forum that the group frequents, where it also posted excerpts of the data it claimed to have obtained.
According to the leaked samples, the compromised records include full names, email addresses, phone numbers, dates of birth, and, crucially for the group’s stated motive, details of users’ cryptocurrency holdings within Revolut’s platform. The hackers specifically singled out accounts that hold large balances of Bitcoin, Ethereum and other major tokens, suggesting they are targeting high‑value targets that could be coerced into paying the ransom. Revolut’s official response was swift but measured. In a public statement released on its corporate blog and social media channels, the company said it had become aware of the claim and was working with law‑enforcement agencies and independent security experts to assess the situation.
Revolut emphasized that it had not received any direct contact from the alleged perpetrators, such as a ransom note or a secure communication channel, and that the company’s internal investigations had not yet confirmed any breach of its systems. The firm reassured customers that their funds remain safe, noting that the cryptocurrency wallets managed by Revolut are stored in cold storage and are not directly accessible through the compromised data.
Cyber‑security analysts note that the group’s choice of Monero for the ransom is a strategic one. Unlike Bitcoin or Ethereum, Monero employs ring signatures, stealth addresses and confidential transactions, which obscure the sender, receiver and transaction amount. This makes it far more challenging for investigators to trace the flow of funds, thereby reducing the risk of the ransom being intercepted or the attackers being identified.
The demand for a specific cryptocurrency also serves as a test of the victims’ willingness and ability to acquire such an asset quickly, further narrowing the pool of potential payers to those with significant crypto experience. The incident raises several broader concerns about the security of fintech platforms that blend traditional banking services with crypto offerings.
While Revolut has built a reputation for user‑friendly interfaces and low‑cost currency conversion, the integration of crypto wallets introduces new attack vectors. Hackers can potentially exploit vulnerabilities in the API layers that connect user accounts to blockchain networks, or they may target third‑party services that handle KYC (Know Your Customer) verification and transaction monitoring. In the past, similar groups have leveraged data dumps from compromised platforms to launch credential‑stuffing attacks, phishing campaigns, and even direct fraud against the affected users.
Industry experts advise customers to adopt a layered approach to security. First, enable two‑factor authentication (2FA) on all accounts, preferably using an authenticator app rather than SMS, which can be intercepted. Second, regularly review account activity and set up alerts for any unusual transactions, especially those involving cryptocurrency transfers. Third, consider using a hardware wallet for storing large crypto balances, as these devices keep private keys offline and are immune to remote compromise.
From a regulatory perspective, the episode underscores the growing pressure on fintech firms to meet stringent data‑protection standards. In the European Union, the General Data Protection Regulation (GDPR) imposes heavy fines for data breaches, and the upcoming EU Digital Operational Resilience Act (DORA) will further tighten requirements for cybersecurity risk management. Revolut, which operates under a UK e‑money license and holds several European banking licences, must demonstrate that it has robust incident‑response plans and that it can quickly notify regulators and affected users in the event of a confirmed breach. Law‑enforcement agencies, including the UK’s National Crime Agency (NCA) and Europol’s European Cybercrime Centre (EC3), have been alerted to the threat.
These bodies typically collaborate with private sector security firms to trace ransom payments, even when privacy coins are used, by analyzing network traffic, wallet patterns and any mistakes the attackers might make when moving funds. Although the odds of recovering the ransom are low, the involvement of authorities can deter the criminals from following through on their threat to sell the data.
In the meantime, Revolut continues to monitor the situation closely. The company has urged customers not to panic and to refrain from sharing personal information in response to unsolicited messages that claim to be from the company. It also reminded users that Revolut never asks for passwords or private keys via email or phone. For those who suspect their accounts may have been compromised, Revolut recommends changing passwords immediately, reviewing linked devices, and contacting support for a possible account freeze.
The broader lesson for the fintech ecosystem is clear: as financial services become increasingly digitised and intertwined with emerging technologies like blockchain, the attack surface expands. Companies must invest in continuous security testing, employee training, and transparent communication strategies to maintain trust. While the current threat remains unverified, the mere possibility of a data breach that could expose millions of users’ personal and crypto‑related information is enough to keep regulators, investors and consumers on high alert.
The coming weeks will reveal whether the hackers’ claims hold water, and how effectively Revolut can mitigate any potential fallout.