Revolut Customer Data Exposed After Unauthorized Government Request, Bitcoin Records Included

Highlights:

• Revolut disclosed customer data after responding to a fake government request sent from an official agency domain.
• Exposed information may include identity documents, contact details, account records, withdrawals, and full Bitcoin transaction histories.
• Revolut blocked the unauthorized address, alerted regulators, and added protection measures for customers affected by the incident.

Revolut disclosed personal and financial information belonging to some customers after receiving an information request from an unauthorized email account operating inside a government agency’s domain. The exposed records may have included identity documents, account statements, withdrawal details and full transaction histories, including Bitcoin activity.

Former Mt. Gox CEO Mark Karpelès shared details of the incident on X on September 12, citing a security notice Revolut sent to affected customers. Revolut has not confirmed the exact number of customers involved or the full scope of the disclosure. According to the notice Karpelès shared, the request appeared to come from a legitimate government authority. The unauthorized email account had been created within the agency’s official domain and carried valid domain authentication credentials.

Revolut said:

“The communication carried genuine domain authentication credentials leading Revolut to fulfill the request under the reasonable belief that it was an authentic government agency request.”

Revolut customers were targeted in a fraudulent emergency data request sent via an email at a "government agency." https://t.co/sS2sbwAt8r

— Mark Karpelès (@MagicalTux) September 12, 2026

Revolut Says Sensitive Customer Data May Have Been Shared

The information potentially disclosed goes well beyond basic account details. According to Revolut’s notice, the data may have included customers’ full names, dates of birth and occupations. Contact information such as home addresses, email addresses and telephone numbers may also have been shared.

More sensitive verification records were potentially involved as well. These included copies of passports or driver’s licences and facial verification images submitted during Revolut’s Know Your Customer, or KYC, process.

Revolut said the incident did not expose biometric facial telemetry data. However, the company may have shared financial details such as account statements, IBANs, account status, opening dates, and wallet reference numbers. The disclosure may also have included withdrawal records and complete transaction histories, including Bitcoin transactions. The Bitcoin data gives the incident a clear crypto angle, particularly for customers who used Revolut to buy, sell, or transfer BTC.

Revolut Blocks Address and Notifies Regulators

Revolut said it investigated the request after becoming aware of the problem and contacted the government agency directly to verify it. That check reportedly alerted the authority to the unauthorized account operating within its own domain infrastructure.

After confirming the issue, Revolut blocked the email address across its internal systems. The company also began notifying relevant regulators and introduced additional protection measures for affected customers. Karpelès said customers affected by the incident should have received an “Urgent security update about your Revolut account” email. However, several important questions remain unanswered. The government agency involved has not been publicly identified, while the exact email address used for the request is also unknown.

Karpelès argued that identifying the affected government authority matters because other banks, financial companies, or cryptocurrency exchanges could have received requests through the same compromised channel. Revolut publicly directs government authorities and legal representatives through dedicated channels when submitting court orders and official information requests.

As of September 12, Revolut’s public news page did not show a separate announcement detailing the incident. The number of affected customers and whether other financial institutions received similar requests remain unclear.