In early 2024 a cyber‑criminal group that had previously been linked to several high‑profile data breaches announced a bold extortion campaign aimed at Revolut, the UK‑based financial‑technology firm known for its multi‑currency accounts and popular crypto services. The group publicly demanded a payment of three million US dollars, to be made in the privacy‑focused cryptocurrency Monero, and warned that if the demand was not met within 24 hours they would put the personal and financial data of Revolut’s customers up for sale on underground markets.
The threat was delivered through a series of posts on a well‑known hacker forum, where the actors claimed they had infiltrated Revolut’s internal systems and extracted a large volume of sensitive information. According to the post, the data set includes names, email addresses, phone numbers, and, most importantly, details of customers who hold substantial amounts of cryptocurrency in their Revolut wallets. By focusing on high‑value crypto holders, the attackers hope to maximise the pressure on the company, knowing that the loss of such accounts could translate into significant financial damage for both the users and the platform. Revolut’s official response was swift but measured.
In a statement released to the press, the company said it had not received any direct contact from the individuals behind the threat and that its security teams were already investigating the matter. The firm emphasized that it continuously monitors its systems for suspicious activity and works closely with law‑enforcement agencies to address any potential breach. Revolut also reassured its customers that their funds remain safe, noting that the company employs a range of security measures, including two‑factor authentication, cold storage for crypto assets, and regular security audits.
The demand for payment in Monero is noteworthy. Monero is a privacy‑centric cryptocurrency that obscures transaction details, making it difficult for investigators to trace the flow of funds. This choice reflects a broader trend among ransomware and extortion groups that are increasingly opting for privacy coins to evade detection and complicate recovery efforts. By demanding Monero, the attackers are signalling both technical sophistication and an awareness of the challenges faced by law‑enforcement when trying to follow the money trail.
Industry experts warn that the public nature of the threat could be a strategic move designed to amplify fear among Revolut’s user base. By openly naming the company and specifying a short deadline, the group hopes to generate media coverage, which in turn can increase the perceived value of the stolen data on the black market.
Cyber‑crime analysts note that the sale of personal data—especially when combined with cryptocurrency wallet information—can be highly lucrative. Buyers may use the data for phishing campaigns, identity theft, or to directly siphon funds from compromised wallets.
The incident also raises broader questions about the security of fintech platforms that integrate traditional banking services with crypto trading. While Revolut has built a reputation for offering a seamless experience across multiple asset classes, the convergence of banking and digital assets creates a larger attack surface.
Regulators in several jurisdictions have been calling for stricter oversight of crypto‑related services, arguing that the rapid growth of these offerings has outpaced the development of robust security frameworks. In the aftermath of the announcement, cybersecurity firms have begun scanning for any signs of data leakage associated with the breach.
So far, there have been no confirmed reports of the stolen data appearing on known dark‑web marketplaces, but investigators remain vigilant. Some analysts suggest that the attackers may be using a “double‑extortion” tactic: first demanding a ransom to prevent the public release of the data, and then planning to sell the information regardless of payment, thereby maximizing their profit. For Revolut customers, the immediate advice is to stay alert and adopt best‑practice security habits.
Users should enable two‑factor authentication, regularly review account activity, and be wary of unsolicited communications that request personal information or direct them to unfamiliar websites. Those who hold significant crypto balances within Revolut are encouraged to consider moving a portion of their assets to cold storage solutions, where private keys are kept offline and are therefore insulated from online attacks.
Law‑enforcement agencies, including Europol’s European Cybercrime Centre (EC3) and the UK’s National Crime Agency (NCA), have been notified of the threat. While the public details of the investigation remain limited, officials have reiterated their commitment to collaborating with private sector partners to track down the perpetrators and disrupt the illicit networks that facilitate such extortion schemes. The episode underscores the evolving nature of cyber‑threats faced by financial institutions that operate at the intersection of traditional banking and emerging digital assets.
As more consumers turn to platforms like Revolut for convenient access to cryptocurrencies, the incentive for criminal groups to target these services grows. Companies must therefore continue to invest in advanced threat detection, employee training, and incident response capabilities to stay ahead of increasingly sophisticated attackers. In conclusion, the demand for a $3 million Monero ransom and the threat to sell stolen Revolut customer data illustrate a chilling blend of financial extortion and data‑theft tactics that are becoming more common in the crypto‑centric cyber‑crime landscape. While Revolut has not confirmed a breach, the public warning serves as a reminder that both users and providers must remain vigilant, adopt strong security measures, and cooperate with authorities to mitigate the risks posed by these high‑stakes cyber‑attacks.