In a startling development that underscores the growing intersection between financial technology services and cyber‑crime, a hacker collective has publicly claimed responsibility for a data breach involving Revolut, the popular UK‑based digital banking and money‑transfer platform. According to the group’s statement, they have exfiltrated personal and financial information belonging to a subset of Revolut’s user base—specifically targeting accounts that hold substantial cryptocurrency assets. The attackers have set a deadline of 24 hours for the company to transfer a ransom of three million US dollars, payable in the privacy‑focused cryptocurrency Monero (XMR). If the demand is not met, they warn that they will begin to sell the stolen data on underground markets, potentially exposing millions of users to identity theft, fraud, and other malicious activities.
The announcement was posted on a well‑known hacking forum, where the group provided a brief overview of their operation. They claimed to have gained access to Revolut’s internal systems through a sophisticated phishing campaign aimed at employees, as well as exploiting an unpatched vulnerability in a third‑party service that the fintech company integrates with for cryptocurrency transactions. By leveraging these entry points, the attackers say they were able to retrieve a database containing names, email addresses, phone numbers, and, crucially, wallet addresses linked to users’ crypto holdings.
The group emphasized that they were not interested in the broader user base, but rather in those customers who had amassed sizable crypto portfolios, which could be leveraged for further extortion or sold to other criminal enterprises. Revolut, which has rapidly expanded its services to include crypto buying, selling, and holding, responded to the allegations with a brief statement. The company asserted that it has not received any direct communication from the alleged perpetrators, nor has it observed any evidence of a breach in its internal security monitoring tools.
Revolut’s security team reportedly launched an immediate investigation, involving external cybersecurity specialists and law‑enforcement agencies, to verify the claims and assess any potential impact on its customers. The firm reiterated its commitment to safeguarding user data and emphasized that it follows industry‑standard encryption and multi‑factor authentication protocols to protect sensitive information.
The demand for payment in Monero is notable. Unlike Bitcoin or Ethereum, Monero is designed to obscure the sender, receiver, and transaction amount, making it a preferred medium for illicit actors seeking to evade traceability. By demanding payment in this privacy‑centric coin, the hackers aim to reduce the likelihood of law‑enforcement tracking the ransom flow.
The requested sum—three million dollars—places this incident among the more financially significant ransomware demands targeting fintech firms in recent years. Cyber‑security experts caution that even if Revolut’s internal systems were not compromised, the attackers might have obtained data from a third‑party vendor or from an auxiliary service that processes crypto transactions on behalf of Revolut. Supply‑chain attacks have become increasingly common, as they allow threat actors to bypass the robust defenses of a primary target by infiltrating a less secure partner.
In this scenario, the stolen information could include wallet addresses that, while public on the blockchain, become more valuable when paired with personally identifiable data, enabling targeted phishing or social engineering attacks. The potential fallout from the breach, should the data be leaked, is multifaceted.
First, identity thieves could use the personal details to open fraudulent accounts, apply for loans, or commit other forms of financial fraud. Second, the exposure of crypto wallet addresses linked to real‑world identities could facilitate “dusting” attacks, where small amounts of cryptocurrency are sent to a victim’s wallet to de‑anonymize them. Third, the data could be packaged and sold on darknet marketplaces to other criminal groups, who might then launch further extortion campaigns, such as demanding additional payments to prevent the publication of the stolen information. Regulators in the United Kingdom and across the European Union have expressed heightened concern over the security of digital banking platforms, especially as they expand into the volatile world of digital assets.
The Financial Conduct Authority (FCA) has previously issued guidance on the handling of crypto‑related services, emphasizing the need for robust cyber‑risk management, thorough vendor due‑diligence, and transparent communication with customers in the event of a breach. If the allegations are substantiated, Revolut could face scrutiny regarding its risk assessment processes and its ability to protect user data in an increasingly hostile cyber environment. From a broader perspective, the incident illustrates the shifting threat landscape for fintech companies.
Traditional banks have long been prime targets for cyber‑criminals, but the rise of app‑based banking and integrated crypto services introduces new attack vectors. The convergence of financial services and blockchain technology creates a lucrative prize for attackers: not only can they steal fiat‑linked personal data, but they can also gain insight into high‑value crypto holdings that can be leveraged for further monetary gain. In the coming days, several outcomes are possible.
If Revolut confirms that a breach occurred, the company will likely initiate a coordinated disclosure process, informing affected customers, offering credit‑monitoring services, and possibly requiring users to reset passwords or enable additional security measures. Law‑enforcement agencies, such as the UK's National Crime Agency (NCA) and the FBI, may become involved to track the ransom payment and identify the threat actors. Conversely, if the investigation finds no evidence of a breach, Revolut may still need to address the reputational damage caused by the public claim, reassuring users that their data remains secure. For customers, the best course of action is to remain vigilant.
Users should monitor their accounts for any unusual activity, enable all available security features (including biometric login and two‑factor authentication), and be wary of unsolicited communications that reference the alleged breach. If a user receives a suspicious email or message that appears to reference personal data, they should report it directly to Revolut’s support channels and avoid clicking on any links.
The episode serves as a reminder that the digital financial ecosystem is still maturing, and both providers and users must stay proactive in the face of evolving cyber threats. While the demand for a three‑million‑dollar Monero ransom may seem extreme, it reflects the high stakes involved when large sums of cryptocurrency are at play.
Whether the hackers follow through on their threat to sell the data or not, the incident will likely prompt fintech firms worldwide to reassess their security postures, strengthen vendor oversight, and enhance transparency with their user bases about potential risks and mitigation strategies. In summary, a hacker group has publicly claimed to have stolen data from Revolut’s customers who hold significant cryptocurrency balances, demanding a $3 million Monero ransom and threatening to put the information up for sale. Revolut denies any direct contact and says an investigation is underway.
The situation highlights the growing risk profile of fintech platforms that blend traditional banking with crypto services, the attractiveness of privacy‑focused cryptocurrencies for ransom payments, and the importance of robust cyber‑risk management across the entire service supply chain.