Revolut hackers demand $3M in Monero after sophisticated phishing breach

The breach did not stem from a direct assault on Revolut’s infrastructure. Instead, attackers successfully impersonated a legitimate government agency, using an email domain that bypassed the bank's authentication protocols. Once inside the communication channel, the perpetrators obtained unauthorized access to personal data, including passports, driving licenses, and complete transaction logs. Revolut confirmed the incident but maintained that its internal systems remained secure and that no customer funds were compromised.

Targeting high-net-worth accounts

The attackers reportedly leveraged blockchain analysis to isolate high-value targets, potentially linking anonymous crypto addresses to verified personal identities. While Revolut has described the number of affected users as a "very limited" portion of its total customer base, the nature of the exposed data poses a significant risk of follow-up phishing attacks. By combining government-issued IDs with specific Bitcoin transaction records, the criminals possess the necessary information to craft highly convincing social engineering scams. The bank has since blocked the fraudulent email address and alerted data-protection authorities, though it has yet to confirm whether it intends to negotiate with the extortionists or identify the specific government agency exploited in the scheme.