Hackers priced 680 Revolut customer files at roughly $4,300 each
The group calling itself iamnotavillain wants 6,000 Monero within 24 hours and Revolut says no demand has reached it. The data went out through a government email account the bank was obliged to answer.
The Investor · Invest desk
What happened
- The Financial Times reported on Sept. 16 that a group calling itself iamnotavillain was threatening to sell confidential information on hundreds of Revolut customers unless the bank paid roughly $3 million within 24 hours.
- The records left after the hackers compromised an Italian government email system, and at least 680 Revolut customer accounts were affected.
- The leaked material includes names, dates of birth, home addresses, phone numbers, ID documents, verification selfies, bank statements and transaction lists.
- Revolut told the FT that it has not received any direct contact or demand from the individuals or group making the claims.
- Former Mt. Gox executive Mark Karpeles said he was affected and shared a Revolut notification stating that details about his Bitcoin transactions were revealed, The Block reported.
Why it matters
- Who's exposed exposure The exposure here lands on customers: Chainalysis says victims of violent crypto attacks are commonly identified from leaked data, social media or blockchain analysis before the attack.
- What it limits constraint The attackers posed as law enforcement across several months of requests. A platform can no longer treat an official-looking demand as authenticated, and every lawful request now costs verification time too.
- What doesn't add up contradiction A public demand with a clock on it means there is no private channel to settle in, so the bank's denial and the attackers' price reach regulators and reporters at the same moment.
- Who has to decide decision With 65% of firms already planning to adopt or expand KYC automation in the coming year, the industry's answer to a compliance-channel breach adds more verified identity data to the same pathways.
Next story · Invest · yesterday
Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chainsConfirmed6 publishers
Divide the $2.9 million demand across the 680 files and each customer record has been priced at about $4,265 [22]. The demand itself was 6,000 XMR, which implies a Monero rate near $483 [1][23]. Revolut has described the number of affected customers only as "limited", and the 680 figure comes from a single source cited by Reuters [6]. Pricing at that level assumes a buyer who wants particular people, and the on-chain analyst ZachXBT said the targeting looked deliberate: "While the incident is likely limited in size it seems to have been targeted at high net worth users." [14]
The files were taken out through a channel Revolut is obliged to answer. The company says its core systems and client funds were not compromised. An email account on a legitimate government agency's domain was used to submit fraudulent information requests, which Revolut called a "sophisticated external impersonation scam" and blocked once it identified it [9]. The attackers also sent the Financial Times a video clip of someone paging through the cache, driver's licences, passports and KYC identity pictures included [11]. PYMNTS wrote that "The next risk perimeter may include the institutions banks are required to trust, something harder to control." [25]
Reuters reported that Revolut had received no ransom demand or direct contact from the attackers [5], while the message the FT saw ended, "all the data will be sold, and the blood will be on your hands" [3]. Revolut says it has notified law enforcement and regulators [13]. It also holds conditional approval to form a national bank [21], so the supervisors following the coverage are the ones holding that application.
Cryptopolitan frames the fallout as pressure on centralized platforms to secure KYC data, higher compliance costs, and renewed interest in self-custody and privacy [26]. The first two have numbers behind them. On the third, the FCA found that 73% of UK crypto users obtain assets through centralized exchanges [19], and nothing in these reports measures anyone leaving. Self-custody takes the exchange balance out of reach; it does not take back the passport scan, the verification selfie and the home address a platform has already collected [10].
The cost I would expect to recur is request authentication, meaning the people and controls that confirm a police or government demand is genuine before an operations team answers it. The European Banking Authority already ranks cyber risk and data security as the leading operational-risk driver for banks, with fraud second [18]. The counter-case is physical safety, and it has the sharper numbers. CertiK verified 52 physical attacks in the first half, 33 of them in France, about 63% [17][24]. Home invasions rose from one in the first half of 2025 to 20, on a dataset CertiK itself calls indicative [17].
This reading is wrong if the cache is published, the addresses get used, and retail volumes actually move off centralized venues. The FCA's 73% is the baseline to measure that against [19].
What to watch
- Whether Revolut replaces "limited" with a disclosed victim count, and whether it lands above 680.
- Whether the cache appears for sale or on the dark web once the 24-hour deadline lapses.
- Whether European supervisors require platforms to independently verify emergency data requests from government domains.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence55
Perspective Coverage
3 publishers- Builder
- Builder 22%
- Operator
- Operator 51%
- Investor
- Investor 27%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The hackers' message told Revolut to pay 6,000 XMR, or Monero, worth $2.9 million as of early Thursday Sept. 17.
- [2]
The group known as "iamnotavillain" is threatening to sell confidential information about hundreds of customers unless Revolut pays a roughly $3 million ransom within 24 hours, the Financial Times reported Wednesday, Sept. 16.
- [3]
If Revolut does not pay, "all the data will be sold, and the blood will be on your hands," the message said.
- [4]
"Revolut has not received any direct contact or demand from the individuals or group making these claims," the company told the FT.
- [5]
Reuters said Revolut had received no ransom demand or direct contact from the attackers.
- [6]
One source cited by Reuters said around 680 customer files had been compromised, although Revolut has offered no specifics, referring to the number of affected customers only as "limited".
- [7]
The data breach affected at least 680 customer accounts and happened when the hackers compromised an Italian government email system.
- [8]
Posing as law enforcement, the hackers were able to demand information on specific Revolut customer accounts over several months, with the goal of targeting "crypto whales" at Europe's most valuable FinTech, according to an earlier FT report.
- [9]
Revolut says its core systems and client funds were not compromised; instead an email account from the domain of a legitimate government agency was used to submit fraudulent information requests, which the company called a "sophisticated external impersonation scam" and blocked once it became aware.
- [10]
The leaked information included names, dates of birth, home addresses, phone numbers, ID documents, verification selfies, bank statements and transaction lists.
- [11]
Soon after posting the ransom demand, the hackers sent the FT a video clip showing an unseen user combing through the cache of purported Revolut documents, including customer driver's licenses, passports and identity pictures for KYC verification.
- [12]
The FT notes that the public demand is unusual, as hackers normally make ransom requests in private, going public only if their target refuses to pay or engage, typically by releasing details of the hack onto the dark web.
- [13]
Revolut has said its systems and customer funds were not affected by the breach, and that it has notified law enforcement and regulators.
- [14]
"While the incident is likely limited in size it seems to have been targeted at high net worth users." - on-chain analyst ZachXBT
- [15]
The Block reported that former Mt. Gox executive Mark Karpeles said he was affected by the breach and shared a notification from Revolut saying details about Bitcoin transactions were revealed.
- [16]
Chainalysis says many violent crypto attacks are premeditated, with victims identified through leaked data, social media, blockchain analysis or insider information, and that its figures likely undercount real losses because many attacks go unreported.
- [17]
France accounted for 33 of CertiK's 52 verified physical-attack cases in H1, while home invasions jumped from one in H1 2025 to 20; CertiK calls its dataset indicative rather than exhaustive.
- [18]
The European Banking Authority ranks cyber risk and data security as the leading operational-risk driver for banks, followed by fraud.
- [19]
FCA research found that 73% of UK crypto users obtain assets through centralized exchanges.
- [20]
PYMNTS Intelligence data from August showed that 65% of firms plan to adopt or expand identity verification and KYC automation within the next 12 months.
- [21]
Revolut has just received conditional approval for forming a national bank.
- [22]
The $2.9 million demand works out to about $4,265 per compromised customer file across 680 files.
- [23]
A demand of 6,000 XMR valued at $2.9 million implies a Monero price of about $483.
- [24]
France's 33 of CertiK's 52 verified H1 physical-attack cases is about 63% of the total.
- [25]
"The next risk perimeter may include the institutions banks are required to trust, something harder to control," a PYMNTS report said.
- [26]
Cryptopolitan describes the bigger fallout as pressure on centralized platforms to secure KYC data, higher compliance costs, and renewed interest in self-custody and privacy.
Sources
3 independent publishers whose own reporting we read for this story.
- cryptopolitan.comRevolut hackers demand $3 million as breach exposes crypto holders' data
1 article · September 16, 2026
- decrypt.coRevolut Hackers Demand $3M Monero Ransom, Threaten to Sell Customer Data: Report
1 article · September 17, 2026
- pymnts.comRevolut Hackers Issue $3 Million Ransom for Customer Data
1 article · September 17, 2026
Topics and entities
Topics
- Fraudulent law enforcement data requests
- KYC data security
- Crypto Wrench Attacks
- Data Extortion