In early June 2024, a shadowy hacking collective that had previously claimed responsibility for a series of high‑profile data breaches announced a new extortion attempt targeting the customers of Revolut, the London‑based financial‑technology platform that offers banking, currency exchange, and cryptocurrency services to millions of users worldwide. The group, which has not publicly identified itself but is often referred to in security circles as the "BlackByte" or "CryptoRansom" gang, posted a detailed threat on a popular underground forum, demanding a payment of three million US dollars worth of Monero (XMR), a privacy‑focused cryptocurrency, within a 24‑hour window. Failure to meet the deadline, according to the hackers, would result in the public release or sale of the personal data of Revolut users, with a particular emphasis on those holding significant crypto assets.
The threat was accompanied by a screenshot that purportedly showed a sample of the stolen data, including email addresses, phone numbers, and partial wallet addresses. While the authenticity of the screenshot could not be independently verified at the time of writing, security analysts noted that the data format matched previous leaks attributed to the same group, which had previously targeted platforms such as Binance, Coinbase, and several decentralized finance (DeFi) projects. The hackers claimed they had exfiltrated information from Revolut's internal systems, specifically focusing on users who had linked their accounts to external crypto wallets or who had engaged in large‑volume trades on the platform's built‑in exchange. Revolut responded promptly to media inquiries, stating that it had not received any direct communication from the alleged perpetrators and that its security team was actively investigating the claim.
A spokesperson for the company emphasized that Revolut employs multiple layers of encryption and monitoring to protect user data and that there was no evidence at that moment that any customer information had been compromised. The firm also reassured its customers that no unauthorized transactions had been detected on any accounts and urged users to remain vigilant for phishing attempts that might arise in the wake of the announcement.
Cyber‑security experts warned that the public posting of a ransom demand, especially one that specifies a privacy coin like Monero, is a common tactic designed to intimidate both the target organization and its user base. Monero's built‑in anonymity features make it a preferred medium for illicit payments because it obscures the sender, receiver, and transaction amount, thereby complicating law‑enforcement tracking.
The $3 million figure, while substantial, is relatively modest compared to the potential market value of the data the hackers claim to possess, suggesting that the group may be seeking a quick payout rather than a prolonged negotiation. The incident also raises broader concerns about the security of fintech platforms that integrate traditional banking services with cryptocurrency functionalities.
Revolut, like many of its competitors, allows users to buy, sell, and hold a variety of digital assets directly within its app. While this convenience has attracted a growing user base, it also expands the attack surface for malicious actors who may attempt to exploit vulnerabilities in the API connections between the fintech service and external blockchain networks. In recent years, several high‑profile breaches have demonstrated that even well‑funded companies can fall victim to sophisticated supply‑chain attacks, credential stuffing, and insider threats.
Analysts from the cybersecurity firm Mandiant noted that the timing of the threat could be linked to recent regulatory scrutiny of cryptocurrency services in the European Union, particularly the implementation of the Markets in Crypto‑Assets (MiCA) framework. As regulators tighten compliance requirements, fintech firms are under pressure to enhance their Know‑Your‑Customer (KYC) and Anti‑Money‑Laundering (AML) processes, which in turn generates more sensitive data that could be attractive to extortionists. The hackers' focus on users with "significant crypto holdings" suggests they are attempting to maximize the perceived value of the data, hoping that wealthy individuals or institutional investors would be more willing to pay a ransom to avoid exposure. In the wake of the announcement, cybersecurity researchers advised Revolut customers to take immediate precautionary steps.
These include changing passwords, enabling two‑factor authentication (2FA) where possible, reviewing recent account activity for any unauthorized transactions, and being wary of unsolicited emails or messages that request personal information or direct users to suspicious login pages. Users who have linked external wallets to their Revolut accounts should also consider rotating their wallet addresses and monitoring blockchain activity for any irregular movements. The broader community of security professionals is watching the situation closely, as the outcome may set a precedent for how fintech companies respond to ransomware and data‑extortion threats involving cryptocurrency.
If Revolut were to comply with the ransom demand, it could encourage similar attacks on other platforms, potentially normalizing the payment of extortion in privacy coins. Conversely, a refusal to pay, coupled with a successful mitigation and public disclosure of the breach, could reinforce the stance that paying ransoms only fuels criminal activity. Law‑enforcement agencies, including Europol's European Cybercrime Centre (EC3), have been notified of the threat, and a joint task force is reportedly gathering intelligence on the actors behind the claim.
While the anonymity of Monero makes tracing the funds challenging, investigators can still employ blockchain analysis techniques, monitor known exchange addresses, and collaborate with cryptocurrency mixers that may inadvertently reveal transaction patterns. As of the latest update, no confirmed data leak from Revolut has been reported, and the company continues to assure its users that their assets remain secure. The situation underscores the evolving risk landscape faced by financial institutions that blend traditional services with emerging digital assets. It also highlights the importance of robust incident response plans, continuous security monitoring, and transparent communication with customers during potential crises.
In summary, a hacker group has issued a 24‑hour ultimatum to Revolut, demanding three million dollars in Monero and threatening to expose or sell data belonging to users with large cryptocurrency balances. Revolut denies any direct contact from the attackers and is investigating the claim. The incident brings to light the challenges fintech firms face in safeguarding user data amid the growing integration of crypto services, the allure of privacy‑centric ransom payments, and the broader implications for regulatory compliance and industry best practices.
Users are urged to stay alert, secure their accounts, and await further official updates from Revolut and relevant authorities.