In early March, a cyber‑criminal collective that has been linked to a series of high‑profile data leaks announced a bold extortion scheme targeting the popular financial‑technology firm Revolut. The group, which operates under the moniker “Ransomware X” in various underground forums, issued a public statement demanding a payment of three million US dollars, to be made in the privacy‑focused cryptocurrency Monero (XMR). The attackers warned that if their demand was not met within a 24‑hour window, they would begin to publicly release the personal and financial information of Revolut’s customers, with a particular focus on those who hold substantial cryptocurrency assets. The threat was disseminated through a mixture of darknet channels, including a Telegram group used by the attackers to coordinate their operations and a post on a well‑known hacking forum that specializes in data‑theft sales.
In the message, the group claimed to have exfiltrated a large dataset containing usernames, email addresses, phone numbers, and, critically, details about users’ crypto wallets and transaction histories. They emphasized that their primary target were “high‑value” customers—individuals who have deposited or traded significant sums of Bitcoin, Ethereum, or other digital assets through Revolut’s platform.
According to the extortion note, the stolen data also includes copies of government‑issued identification documents, such as passports and driver’s licences, as well as proof‑of‑address documents. The attackers suggested that the information could be leveraged for identity theft, fraud, or further black‑mail attempts.
By demanding payment in Monero, they sought to obscure the transaction trail, making it more difficult for law‑enforcement agencies to trace the funds. Revolut’s official response was swift but measured.
In a press release issued later that same day, the company stated that it had not received any direct communication from the alleged perpetrators beyond the publicly posted demand. Revolut’s security team, which works in conjunction with external cyber‑security partners, was already investigating the claim as a matter of priority. The firm assured its users that it employs robust encryption and multi‑factor authentication mechanisms to protect account data, and that there was no evidence at the time of the statement that any customer accounts had been compromised. The company also emphasized that it follows strict data‑privacy regulations, including the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States.
Revolut’s spokesperson highlighted that, should any breach be confirmed, the firm would promptly notify affected customers and cooperate fully with relevant authorities, including the UK’s National Cyber Security Centre (NCSC) and the US Federal Bureau of Investigation (FBI). Cyber‑security experts have weighed in on the situation, noting that the demand for a large sum in Monero is a common tactic among sophisticated threat actors. Monero’s privacy‑by‑design architecture, which hides both the sender’s and receiver’s addresses as well as the transaction amount, makes it a preferred medium for illicit payments.
Analysts at a leading cybersecurity firm pointed out that the 24‑hour deadline is intended to create a sense of urgency, pressuring the victim organization to act quickly, often before a thorough forensic investigation can be completed. The incident also raises broader concerns about the security of fintech platforms that bridge traditional banking services with cryptocurrency trading.
Revolut, like many of its competitors, offers users the ability to buy, hold, and exchange a variety of digital assets directly within its app. While this convenience has attracted millions of users worldwide, it also expands the attack surface for cyber‑criminals who are eager to exploit any weaknesses in the integration of legacy banking infrastructure with emerging blockchain technologies. In the aftermath of the threat, several security researchers have recommended a series of best practices for both fintech companies and their customers.
For providers, these include implementing continuous monitoring of data exfiltration channels, employing advanced threat‑hunting tools that can detect anomalous behavior, and conducting regular penetration testing focused on API endpoints used for crypto transactions. For users, experts advise enabling all available security features—such as biometric login, hardware security keys, and transaction alerts—and being cautious about sharing personal details that could be used in social‑engineering attacks.
The situation remains fluid. While Revolut has not confirmed a breach, the mere possibility of a data leak involving sensitive financial and identity information is enough to cause concern among its user base. Many customers have taken to social media platforms to express anxiety and to demand greater transparency from the company regarding its security posture.
If the attackers follow through on their threat and begin publishing the stolen data, the ramifications could be severe. Publicly released personal information can be aggregated with other data sets available on the dark web, enabling fraudsters to craft highly convincing phishing campaigns or to open new accounts in victims’ names. Moreover, exposure of crypto‑wallet details could lead to targeted attacks aimed at draining digital assets, especially if the wallets are not secured with strong passwords or hardware wallets.
Law‑enforcement agencies have historically faced challenges in prosecuting cases involving cryptocurrency‑based extortion, largely due to the anonymity features of coins like Monero. However, international cooperation among cyber‑crime units has improved, and there have been notable successes in tracking and seizing illicit funds, even when they are initially transferred through privacy‑enhanced cryptocurrencies. In summary, a shadowy hacking group has publicly demanded a three‑million‑dollar ransom in Monero from Revolut, threatening to leak a trove of customer data—particularly focusing on users with sizable crypto holdings—if the demand is not met within a day.
Revolut has denied any direct contact from the attackers and is conducting an internal investigation while reassuring its customers of its commitment to security and regulatory compliance. The episode underscores the growing intersection of traditional financial services and cryptocurrency, highlighting the need for heightened security measures, rapid incident response capabilities, and ongoing vigilance by both providers and users in the evolving digital‑finance landscape.