Revolut said a limited number of customers had confidential data exposed after attackers sent fraudulent requests from a legitimate government domain, according to the company and findings cited by researcher ZachXBT.

Researcher ZachXBT said the attackers accessed documents, bank statements and Bitcoin transaction histories. Revolut said several affected customers have already received official notifications. The company did not disclose the exact number of impacted users.

Among the potentially exposed information were full names, dates of birth, home addresses, email addresses, phone numbers, copies of documents, bank statements and transaction histories. Revolut said biometric data was not compromised.

The company said its systems were not breached and customer funds were not affected. After identifying the fraudulent activity, Revolut said it blocked the relevant email address and notified the government agency involved as well as law enforcement.

Some of the affected users may have been wealthy clients, according to the reported findings, but Revolut has not provided further detail on customer segments or on the specific government domain used in the incident. That leaves the full scope of the attack path, targeting criteria and downstream misuse risk undisclosed for now.

Why It Matters

The incident matters because the exposed materials go beyond basic contact information and reportedly include KYC documents, bank records and Bitcoin transaction histories. For crypto users, that combination can create privacy, social-engineering and account-targeting risks even when funds and internal systems remain secure.

It also highlights a broader operational issue for fintech and crypto-linked platforms: customer data risk does not depend only on direct hacks. Fraudulent legal or compliance-style requests can become a separate attack surface, especially where firms hold detailed identity and transaction records for regulated onboarding.