In recent weeks, a cyber‑criminal collective that claims responsibility for a major data breach at the financial‑technology firm Revolut has surfaced with a bold demand: a payment of three million US dollars, to be made in the privacy‑focused cryptocurrency Monero. The group has warned that if the sum is not delivered within a strict 24‑hour window, it will begin to publicly release or sell the personal and financial details of Revolut’s customers, focusing especially on those who hold substantial amounts of digital assets.
The threat was communicated through a series of online postings that detail the attackers’ intentions and outline the ransom terms. According to the messages, the group has already obtained a sizable database containing user names, email addresses, phone numbers, and, crucially, information about cryptocurrency wallets and transaction histories. The hackers specifically mention targeting customers who possess “significant crypto holdings,” suggesting that they have filtered the data to isolate high‑value accounts that could fetch a higher price on the black market.
Monero was chosen as the preferred payment method because of its built‑in anonymity features. Unlike Bitcoin, which has a public ledger that can be traced, Monero obscures both the sender’s and receiver’s identities as well as the transaction amount.
This makes it a favored currency for illicit actors seeking to avoid detection by law‑enforcement agencies. The demanded three‑million‑dollar ransom translates to roughly 1,200 Monero tokens at current market rates, a figure that underscores the attackers’ confidence in the perceived value of the stolen data.
Revolut, a UK‑based challenger bank that has rapidly expanded its services to include crypto trading, has publicly responded to the allegations. In a statement released through its official channels, the company said it has not received any direct communication from the individuals or group making the threats.
Revolut emphasized that it takes the security of its users’ information very seriously and that it is cooperating with relevant authorities to investigate the incident. The firm also reassured customers that no unauthorized transactions have been detected on its platform and that it continues to monitor its systems for any signs of compromise.
Cybersecurity experts note that the pattern of demanding payment in Monero and threatening to leak data is a familiar tactic among ransomware and extortion groups. By offering a short deadline, the attackers aim to create urgency and pressure the victim into paying quickly, before the threat can be mitigated or the data can be secured. The choice to focus on crypto‑savvy users is also strategic; individuals with large cryptocurrency balances are more likely to have the means to pay a high ransom and may be more vulnerable to the prospect of losing access to their digital assets.
If the attackers follow through on their threat, the fallout could be significant. Exposure of personal data such as email addresses, phone numbers, and wallet identifiers can lead to a wave of phishing attacks, social engineering scams, and targeted fraud attempts. Moreover, the public sale of such information on underground forums often results in the data being repackaged and sold multiple times, amplifying the risk for the affected users. Financial regulators and law‑enforcement agencies across Europe have been urged to treat this incident with the utmost priority.
The UK’s National Cyber Security Centre (NCSC) has previously warned about the rising trend of cyber‑criminals exploiting the growing popularity of cryptocurrencies to extort money from both individuals and businesses. In this case, the involvement of a high‑profile fintech company like Revolut adds a layer of complexity, as the breach could undermine confidence in the broader ecosystem of digital banking and crypto services. For customers who may be concerned about their own security, experts recommend a series of precautionary steps.
First, users should enable two‑factor authentication (2FA) on all accounts, especially those linked to financial services and crypto exchanges. Second, they should regularly review account activity and immediately report any suspicious transactions. Third, changing passwords and using a password manager can reduce the risk of credential reuse, which is a common vector for attackers to gain unauthorized access. In addition, individuals who suspect that their personal data may have been compromised should monitor their email inboxes for phishing attempts that reference the leaked information.
Attackers often use known data points to craft convincing messages that lure victims into providing additional credentials or transferring funds. Using a dedicated email address for financial communications and keeping personal and professional email accounts separate can also help mitigate the impact of such attacks. From a broader perspective, the incident highlights the ongoing tension between the rapid adoption of innovative financial technologies and the evolving threat landscape.
As more consumers turn to platforms that blend traditional banking with crypto trading, the attack surface for cyber‑criminals expands accordingly. Companies like Revolut must continuously invest in advanced security measures, including threat detection, encryption, and regular security audits, to stay ahead of sophisticated adversaries. In summary, a hacker group claiming responsibility for a data breach at Revolut has issued a stark ultimatum: pay three million dollars in Monero within 24 hours, or face the public exposure and sale of sensitive customer data, particularly targeting those with large cryptocurrency holdings.
Revolut denies any direct contact from the perpetrators and is working with authorities to investigate. The situation underscores the importance of robust cybersecurity practices for both financial institutions and their users, especially as the line between conventional banking and digital assets continues to blur.