In early June 2024, a cyber‑criminal collective that had previously claimed responsibility for a large‑scale data breach at the popular financial technology platform Revolut announced a bold new demand: three million dollars worth of Monero, the privacy‑focused cryptocurrency, in exchange for halting the public release of compromised user data. The group, which has identified itself only by a cryptic online handle, warned that it would begin selling the stolen information to the highest bidder if its demands were not met within a strict 24‑hour window.
The threat appears to be directed at Revolut’s most valuable customers—those who hold substantial amounts of digital assets, particularly cryptocurrencies, in the app’s integrated wallet service. According to the hackers’ communiqué, the data they have exfiltrated includes personal identifiers such as full names, email addresses, phone numbers, and, crucially, the private keys or seed phrases associated with users’ crypto wallets.
If these credentials were to fall into the hands of malicious actors, the financial loss could be catastrophic, as the assets would be transferred irreversibly to the attackers’ own accounts. Revolut, a London‑based fintech firm that has grown rapidly to serve millions of customers worldwide, responded to the claim with a measured statement.
The company said it had not received any direct contact from the individuals behind the breach, nor had it been presented with any evidence that the data had actually been compromised. Revolut’s spokesperson emphasized that the firm maintains robust security protocols, including encryption of sensitive data and multi‑factor authentication for account access, and that it continues to monitor the situation closely.
The company also reassured its users that no unauthorized transactions have been reported to date. The demand for Monero is notable because the cryptocurrency is deliberately designed to obscure transaction details, making it a favorite among cyber‑criminals who wish to launder proceeds without attracting the scrutiny of law‑enforcement agencies. Unlike Bitcoin, where every transaction is publicly recorded on a blockchain, Monero employs ring signatures, stealth addresses, and confidential transactions to hide the sender, receiver, and amount of each transfer. By asking for payment in this particular coin, the hackers are signaling both a sophisticated understanding of cryptocurrency anonymity tools and a desire to make any potential ransom payment difficult to trace.
Industry analysts point out that the threat to sell the data adds another layer of pressure. In the cyber‑crime ecosystem, stolen personal data—especially when it includes financial credentials—has a high resale value on dark‑web marketplaces. A single set of compromised crypto wallet details can fetch anywhere from a few hundred to several thousand dollars, depending on the size of the holdings and the reputation of the victim.
By threatening to auction off the entire dataset, the group is effectively creating a market‑driven incentive for Revolut to comply with the ransom demand, lest the information become widely disseminated. Cyber‑security experts caution that paying a ransom does not guarantee that the data will be destroyed or that the attackers will refrain from future extortion attempts. In many documented cases, victims who have paid have later found that the criminals either kept copies of the data or returned with additional demands.
Moreover, paying a ransom can embolden the attackers and fund further illicit activity. For these reasons, law‑enforcement agencies typically advise against complying with ransom demands and instead encourage victims to work with forensic investigators to assess the breach and mitigate damage. The broader context of this incident reflects a growing trend of ransomware and extortion campaigns targeting financial service providers that have integrated crypto services into their platforms.
As traditional banks and newer fintech firms expand their digital asset offerings, they become attractive targets for threat actors seeking to exploit the high value and relative novelty of crypto holdings. The anonymity features of certain cryptocurrencies also make it easier for criminals to monetize stolen data without leaving a clear trail. In response to the evolving threat landscape, many fintech companies are bolstering their security posture by adopting zero‑trust architectures, conducting regular penetration testing, and implementing advanced threat‑intelligence monitoring.
Some are also exploring the use of decentralized identity solutions that could reduce the risk of a single point of failure in user authentication. For users, best practices include enabling all available security features, such as biometric login, hardware security keys, and regular rotation of passwords and recovery phrases.
The incident also raises questions about regulatory oversight. In jurisdictions like the European Union, the General Data Protection Regulation (GDPR) imposes strict obligations on companies to protect personal data and to notify authorities and affected individuals in the event of a breach.
Failure to comply can result in substantial fines. Revolut, which operates under the regulatory frameworks of multiple countries, may be required to disclose the breach to data protection authorities if it is confirmed that user data was indeed accessed.
As of now, the situation remains fluid. No definitive proof has emerged that the stolen data has been leaked, and Revolut has not confirmed any breach beyond the public claim made by the attackers. The company continues to advise its customers to remain vigilant, monitor their accounts for any suspicious activity, and report any concerns to Revolut’s security team.
Meanwhile, cybersecurity firms are likely conducting their own investigations, analyzing the attackers’ tactics, techniques, and procedures (TTPs) to better understand the threat and to develop defensive measures for other organizations that might become targets. The episode underscores the delicate balance that fintech firms must strike between offering innovative services—such as integrated crypto wallets—and safeguarding the massive amounts of personal and financial data they collect. As digital assets become more mainstream, the incentive for cyber‑criminals to target these platforms will only increase, making robust security, rapid incident response, and transparent communication essential components of any successful financial technology operation. In summary, a hacker group has issued a 24‑hour ultimatum to Revolut, demanding three million dollars in Monero and threatening to sell the personal and crypto‑related data of its customers if the ransom is not paid.
Revolut denies any direct contact with the perpetrators and has not confirmed a breach. Experts advise against paying the ransom, emphasizing the importance of forensic investigation, user education, and enhanced security measures to mitigate the risk of such extortion attempts in the rapidly evolving fintech and cryptocurrency space.