In a startling development that has sent shockwaves through the financial‑technology sector, a cyber‑crime collective that has taken credit for a recent data breach at Revolut – the popular digital banking and money‑transfer platform – has publicly demanded a ransom of three million US dollars, payable in the privacy‑focused cryptocurrency Monero. The group further warned that, should the company fail to meet its demands within a strict 24‑hour window, it would begin selling the stolen personal and financial information of Revolut’s customers on underground markets, potentially exposing millions of users to identity theft, fraud, and other malicious activities. The threat was first reported by several cybersecurity news outlets after the group posted a message on a well‑known hacker forum, outlining the specifics of their demand. According to the posting, the attackers had successfully exfiltrated a substantial data set that includes names, email addresses, phone numbers, and, most critically, details about users’ cryptocurrency holdings.
The group claimed that they specifically targeted accounts that hold large balances of digital assets, suggesting that they have either performed selective data mining or possess inside knowledge of high‑value users. Revolut, which boasts over 30 million customers worldwide and has positioned itself as a leader in the integration of traditional banking services with crypto‑exchange capabilities, responded swiftly to the allegations.
In an official statement released on its corporate blog and disseminated through its social‑media channels, the company asserted that it had not received any direct communication from the alleged perpetrators. Revolut emphasized that it maintains robust security protocols and that it is actively working with law‑enforcement agencies and independent cybersecurity experts to investigate the incident.
The statement read in part: “We take the security of our users’ data very seriously. At this time, we have not been contacted directly by any party claiming responsibility for the alleged breach.
We are cooperating with relevant authorities and have engaged leading cyber‑security specialists to assess any potential impact and to ensure that our systems remain secure.” Industry analysts note that the demand for payment in Monero is a strategic choice by the attackers. Monero, unlike Bitcoin or Ethereum, employs advanced cryptographic techniques that obscure the sender, receiver, and transaction amount, making it extremely difficult for law‑enforcement agencies to trace the flow of funds. This level of anonymity is attractive to cyber‑criminals seeking to evade detection after a high‑profile extortion attempt. The 24‑hour deadline imposed by the group is also a common tactic in ransomware and extortion schemes.
By creating a sense of urgency, attackers aim to pressure the target into making a quick decision, often before the organization has a chance to fully assess the situation or involve legal counsel. In the case of Revolut, a company with a global footprint and a large user base, the potential reputational damage from a data leak could be significant, which may increase the pressure to comply with the attackers’ demands. If the threat materializes and the stolen data is indeed put up for sale, the ramifications could be far‑reaching. Customer data from fintech platforms is highly valuable on the dark web because it can be combined with other compromised information to facilitate sophisticated fraud schemes, such as account takeover attacks, synthetic identity creation, and targeted phishing campaigns.
Moreover, the inclusion of cryptocurrency wallet addresses and transaction histories could enable criminals to directly siphon funds from high‑net‑worth individuals. Cyber‑security experts advise users of Revolut and similar services to take immediate precautionary steps. These include enabling two‑factor authentication (2FA) on all accounts, regularly updating passwords, monitoring account activity for any unauthorized transactions, and being wary of unsolicited communications that request personal information.
For users who have linked crypto wallets to their Revolut accounts, it is recommended to transfer assets to a hardware wallet or another secure storage solution until the situation is clarified. The broader fintech community is also watching the incident closely.
Over the past few years, there has been a noticeable uptick in attacks targeting platforms that bridge traditional finance and digital assets. The convergence of these two worlds creates a larger attack surface, as cyber‑criminals can exploit vulnerabilities in either the banking infrastructure or the blockchain‑related components. As a result, regulators in several jurisdictions are pushing for stricter security standards and mandatory breach disclosure requirements for crypto‑enabled financial services.
In the meantime, law‑enforcement agencies in the United Kingdom, the United States, and the European Union have reportedly opened parallel investigations. While the details of these probes remain confidential, officials have indicated that they are working to trace the origin of the Monero transaction and to identify any potential links to known hacking groups that have previously targeted financial institutions. The incident underscores the growing challenges that digital‑banking firms face in an era where cyber‑threats are becoming more sophisticated and financially motivated.
As companies like Revolut continue to expand their product offerings, integrating everything from currency exchange to stock trading and cryptocurrency services, they must also invest heavily in security measures that can keep pace with evolving threats. For now, the fate of Revolut’s customers hangs in the balance as the company navigates the delicate process of investigating the breach, communicating transparently with its user base, and cooperating with authorities.
Whether the ransom demand will be met, ignored, or ultimately proven to be a bluff remains to be seen, but the episode serves as a stark reminder of the importance of robust cybersecurity practices in the modern financial ecosystem. In summary, a hacker group has publicly demanded a $3 million Monero ransom from Revolut, threatening to sell the personal data of its customers if the deadline is not met. Revolut denies any direct contact from the attackers and is working with law enforcement and security experts.
Users are advised to strengthen their account security and stay alert for any suspicious activity while the investigation unfolds.