Revolut confirmed this week that customer passports, selfies, and financial transaction histories, including Bitcoin data, were handed to a fraudster who posed as a government official using a hijacked agency domain. The breach, disclosed on September 12, marks another entry in the growing list of KYC exploits that sidestep technical defenses by attacking the human layer.
The attacker didn’t break through firewalls or exploit a smart contract bug. They sent an email from what appeared to be a legitimate government domain and requested customer data. Revolut complied. How many accounts were exposed hasn’t been specified, but onchain investigator ZachXBT suggested the incident wasn’t a spray-and-pray operation. He speculated the fraudster may have been targeting high-net-worth users, meaning the request could’ve been surgical, narrow enough to avoid immediate red flags but wide enough to scoop passports, selfies, and detailed transaction logs tied to specific accounts.
KYC as Attack Surface
Revolut operates in over 30 countries and holds regulated status in several jurisdictions, which means it collects and stores identity documents as part of standard onboarding. That data, passport scans, photo verification, proof of address, is precisely what social engineers hunt. A spoofed government email is low-tech but effective, especially when the domain is authentic and the request mimics standard law enforcement procedure. Revolut didn’t say which agency was impersonated or how long the domain was compromised before they caught on.
The Bitcoin transaction data adds another dimension. Unlike fiat rails, Bitcoin movements are traceable on a public ledger. If the fraudster got account-level detail linking customer identities to specific UTXO histories, those records could be used to profile holdings, track withdrawals, or map connections to other addresses. That’s valuable intelligence for anything from SIM-swap prep to ransomware targeting.
High-Net-Worth Hypothesis
ZachXBT’s comment about high-net-worth users raises the stakes. If the attacker wasn’t casting a wide net, they either had prior knowledge of who banked with Revolut and what their balances looked like, or they submitted a narrow request that Revolut’s compliance team interpreted as routine. Either scenario suggests coordination. Government impersonation isn’t new, tax agencies and financial regulators get spoofed regularly, but pairing it with a data request tight enough to target whales is more sophisticated than the average phish.
Revolut hasn’t disclosed whether the fraudster tried to move funds, open accounts elsewhere using the stolen documents, or sell the data. The company said it’s cooperating with authorities, which in practice means the investigation will be quiet and slow. Meanwhile, the customers whose passports are now in circulation have little recourse beyond credit monitoring and waiting to see if their identity shows up in a credential dump six months from now.
