Revolut Data Theft Targets 680 Crypto Investors in $3 Million Monero Extortion

A cyber-extortion group calling itself “iamnotavillain” has demanded 6,000 Monero (XMR), worth roughly $3 million, after obtaining personal and financial records linked to at least 680 Revolut account holders. The group launched a 24-hour countdown on a website built specifically for the extortion attempt, warning: “all the data will be sold, and the blood will be on your hands.”

The stolen files include customers’ full legal names, dates of birth, residential addresses, occupations, government photo identification documents—including passports and driver’s licenses—and the verification “selfies” submitted during identity onboarding. The attackers also obtained full transaction histories, withdrawal records, account statements containing International Bank Account Numbers (IBANs), and specific crypto wallet references.

Revolut said Wednesday evening that it has not received direct contact or demands from the extortionists. The London-based fintech described the incident as a “sophisticated external impersonation scam” affecting a “limited” number of accounts, and said customer funds and central operational systems remain fully secure. The company declined to name the government agency impersonated in the breach.

The Financial Times received a screen recording in which the attackers displayed the stolen documentation. According to details made public Wednesday, the compromise unfolded over several months through an Italian government email system that had already been breached by the attackers.

Because the requests came from genuine official email domains and included valid administrative authentication, Revolut’s compliance mechanisms treated them as legitimate legal mandates. The incident involved the abuse of a technique known as Emergency Data Request (EDR) abuse.

Instead of carrying out a broad data siphon, the group told the Financial Times that it first conducted blockchain surveillance to locate high-value cryptocurrency wallets. It then traced those on-chain assets to specific Revolut accounts and submitted tailored legal information requests for the real-world identity files associated with the high-net-worth balances.

Pseudonymous blockchain investigator ZachXBT initially circulated Revolut’s customer breach notification. He noted that the exposure of verified physical addresses alongside confirmed cryptocurrency holdings creates severe physical security risks, including targeted home invasions and physical extortion. In the cybersecurity industry, such attacks are often called “wrench attacks,” in which criminals physically target investors to force wallet transfers.

Under international legal protocols, law enforcement agencies can use urgent requests to obtain subscriber records from financial firms, telecommunications providers, and technology companies without waiting for court warrants. Cybercriminals have increasingly compromised official police and municipal government email systems around the world to forge these inquiries and deceive automated compliance systems into disclosing internal customer databases.

Monero was selected for the demanded payment because of its specialized privacy features. Launched in 2014, the cryptocurrency uses ring signatures, stealth addresses, and confidential transactions to obscure the sender, receiver, and exact transaction amounts on its public ledger.

Those privacy mechanics have faced intense scrutiny from global regulators. Over the past year, major cryptocurrency exchanges, including Binance, Coinbase, and Kraken, have delisted Monero to comply with evolving anti-money laundering regulations and the European Union’s Markets in Crypto-Assets (MiCA) framework.

Blockchain analytics firm TRM Labs says cyber-extortion syndicates frequently demand Monero or offer discounts to victims who pay in XMR because the token resists tracking. TRM Labs also notes that Bitcoin remains the dominant currency for corporate extortion settlements because victims can acquire, transfer, and liquidate it at scale more easily through institutional channels.

Founded in 2015 by Nikolay Storonsky and Vlad Yatsenko, Revolut became one of Europe’s most valuable private technology companies after reaching a $45 billion valuation in a secondary share sale in 2024. The firm serves more than 45 million retail customers globally and secured a preliminary U.K. banking license with restrictions in July 2024.

The incident is Revolut’s second major data exposure in recent years. In September 2022, a cyberattack allowed a third party to access the personal details of approximately 50,000 customers, leading to an investigation by data protection authorities in Lithuania, where Revolut holds its European Union banking license.