In early 2024, a cyber‑crime group that had previously been linked to a series of high‑profile data leaks resurfaced with a new extortion campaign aimed at Revolut, the London‑based financial technology firm. The group announced that it had obtained a substantial amount of personal and financial information belonging to Revolut’s customers, including details that could reveal the size of their cryptocurrency holdings. Their demand was stark: a payment of three million US dollars, to be made in the privacy‑focused cryptocurrency Monero, within a 24‑hour window. Failure to comply, they warned, would result in the public release of the stolen data and the sale of the information on underground markets.
The threat was communicated through a series of posts on a popular hacker forum, where the group posted excerpts of the data to prove its authenticity. Among the leaked snippets were email addresses, phone numbers, partial banking details, and, most notably, wallet addresses and transaction histories that indicated significant crypto assets.
By highlighting accounts with large balances, the attackers aimed to pressure Revolut into paying quickly, leveraging the fear that wealthy users would be especially eager to keep their holdings private. Revolut’s official response was measured but firm.
In a public statement, the company said it had not received any direct contact from the attackers and that it was working with law‑enforcement agencies to investigate the incident. The firm also reassured customers that it employs robust security measures and that there was no evidence at the time that any accounts had been accessed or that funds were at risk. Revolut emphasized that it would not negotiate with cyber‑criminals and encouraged users to remain vigilant, especially when dealing with unsolicited communications that might appear to be related to the breach. Cyber‑security experts weighed in on the situation, noting that the demand for Monero is a common tactic among extortion groups because the cryptocurrency offers strong anonymity features.
Unlike Bitcoin, where transaction trails can be traced relatively easily, Monero obscures both the sender and receiver, making it difficult for authorities to follow the money. This choice of payment method signals that the attackers are experienced and are deliberately selecting tools that minimize the risk of detection.
The incident also raises broader concerns about the security of fintech platforms that handle both traditional banking services and cryptocurrency transactions. While Revolut has grown rapidly, offering services such as currency exchange, stock trading, and crypto buying and selling, the integration of these diverse financial products creates a larger attack surface. Hackers may exploit vulnerabilities in one part of the system—such as the API that connects to crypto exchanges—to gain access to broader customer data. Industry analysts suggest that the breach could be part of a larger trend where threat actors focus on firms that serve as gateways between fiat and digital currencies.
By compromising a platform like Revolut, attackers can potentially harvest data that is valuable not only for direct extortion but also for future phishing campaigns, identity theft, and credential stuffing attacks. The stolen information could be used to craft highly targeted social engineering attacks, especially against users who have demonstrated an interest in high‑value crypto assets. In response to the growing threat landscape, many fintech companies are revisiting their security architectures.
Recommendations include implementing zero‑trust networking models, enhancing multi‑factor authentication for both internal staff and customers, and conducting regular penetration testing focused on crypto‑related functionalities. Additionally, firms are urged to adopt robust data encryption both at rest and in transit, and to segment sensitive data so that a breach in one area does not automatically expose the entire customer database. For Revolut’s customers, the immediate advice is to monitor account activity closely and to be wary of any unsolicited messages that reference the breach.
Users should verify the authenticity of communications by contacting Revolut through official channels rather than responding to emails or messages that could be phishing attempts. It is also prudent for customers who hold cryptocurrency on the platform to consider moving their assets to hardware wallets or other custodial solutions that provide an extra layer of security. Law‑enforcement agencies, including the UK’s National Crime Agency (NCA) and Europol’s European Cybercrime Centre (EC3), have been notified of the extortion attempt. These bodies typically collaborate with financial regulators and the private sector to trace illicit cryptocurrency flows and to dismantle criminal networks.
However, the use of Monero complicates these efforts, as its privacy‑enhancing technology is specifically designed to thwart blockchain analysis. The situation remains fluid.
While Revolut has not confirmed any data loss, the public nature of the threat has already sparked concern among its user base and the broader fintech community. The incident underscores the importance of continuous vigilance, both from service providers and from individual users, in an environment where digital assets are increasingly intertwined with everyday financial activities. In summary, a sophisticated hacking group has claimed to possess sensitive Revolut customer data and is demanding a three‑million‑dollar ransom payable in Monero, with a 24‑hour deadline.
Revolut denies direct contact with the perpetrators and is cooperating with authorities. The episode highlights the vulnerabilities inherent in platforms that bridge traditional banking and cryptocurrency services, the attractiveness of Monero for illicit payments, and the need for heightened security measures across the fintech sector. Customers are advised to stay alert, verify communications, and consider additional safeguards for their digital assets while the investigation proceeds.