Revolut said over the weekend that it disclosed sensitive customer information to an unauthorized third party after fraudulent requests for records were submitted from an email account on a legitimate government agency’s domain.
A spokesperson described the case as a "sophisticated external impersonation scam" and said Revolut blocked the address once it identified the fraud.
Notice circulating online lists identity documents and Bitcoin transaction history
A purported notice sent to affected customers and shared online says the exposed data included listed names, dates of birth, postal addresses, email addresses, telephone numbers and copies of identity documents, including passports and driver’s licenses.
The same notice says verification selfies, account statements and transaction histories were also disclosed, including Bitcoin transaction records.
Mark Karpelès says he was affected; ZachXBT points to wealthy users
Mt. Gox former CEO Mark Karpelès, who posted the notice, said he was affected.
ZachXBT, who alerted followers on Saturday, said the incident appeared to have been aimed at high-net-worth users.
Revolut has not disclosed the number of affected users
Revolut has not said how many users were affected. It also has not identified the government agency involved in the fake request.
Case adds to concern over attacks targeting crypto holders
The incident adds to broader concern around wrench attacks that are increasingly targeting people who hold crypto.
Hardware wallet maker Trezor disclosed a structurally similar issue last week, saying a breach at its email provider allowed attackers to send phishing emails from Trezor’s own domain. Days earlier, the company had said a ShipMonk breach exposed another 67,000 U.S. customers.
Revolut is also pushing ahead with banking and stablecoin plans
Revolut says it has more than 80 million customers. This month, the company received conditional approval from the U.S. Office of the Comptroller of the Currency to establish a national bank. In August, it started rolling out its EURR euro stablecoin in Denmark, Poland and Portugal. It is also weighing a listing that could value the company at as much as $200 billion.
Unchained also referenced a related program titled Inside the Coldcard Hack That Drained Over $100 Million in Bitcoin: Uneasy Money.