Revolut reportedly disclosed customer information after acting on an emergency government request that was later found to be fraudulent, according to CoinDesk. The reported disclosure included identity documents and Bitcoin-related records, although no exposure of private keys, seed phrases or direct access to customer funds has been reported.

The incident was not described as an attacker taking control of a wallet or breaking into a customer account. Instead, the apparent failure occurred while Revolut was verifying a request for customer data. That distinguishes it from a typical exchange hack, in which an attacker defeats account protections such as a password or two-factor authentication before accessing funds or information.

Revolut notified affected users after contacting the relevant authority and determining that the emergency request was not genuine. The notice was also shared publicly on X. At the time of writing, Revolut had not issued a broader public statement or disclosed how many accounts were affected, leaving the scale of the incident unclear.

“Revolut customers were targeted in a fraudulent emergency data request sent via an email at a “government agency.” — Mark Karpelès (@MagicalTux) September 12, 2026”

The post was published by Mark Karpelès on X, with the referenced URL available at

Why the Bitcoin-related records matter

CoinDesk reported that the disclosed material included identity documents, account information, withdrawal records and Bitcoin-related transaction history. The customer notice did not indicate that private keys, seed phrases or direct access to customer funds had been exposed.

Blockchain records do not contain passport details. The security concern arises when a regulated platform’s records connect transactions to a verified identity. If wallet references, withdrawal details or transaction identifiers can be matched with public blockchain activity, that connection could remain useful to attackers even after a customer changes an account password.

Revolut has said that it maintains an internal ledger for customer crypto exposure. As a result, the reported Bitcoin transaction history may refer to activity recorded inside Revolut rather than a complete list of public blockchain addresses. Revolut should clarify whether the disclosed information included external wallet addresses, transaction identifiers, destination information or only internal account history. Those categories would create different levels of exposure and would affect how easily an attacker could connect a customer’s identity to visible on-chain activity.

Customer funds may remain safe while impersonation risks increase

The incident was not described as a custody breach in the usual sense. However, a detailed identity-and-activity profile can support fraudulent contact over an extended period. Someone who knows that a person used Bitcoin, has the person’s contact information and can cite a genuine withdrawal would have a more credible basis for impersonating a support or compliance representative.

A similar concern was identified after the Bits of Gold customer-data breach. Even when assets and private keys remain inaccessible, identity and wallet-related records can make impersonation attempts more convincing.

A scammer does not need a seed phrase to exploit such information. The attacker could request a one-time code, claim that a wallet must be moved to a “secure” address, or direct the victim to a copy of a legitimate support page. The appropriate response is verification and caution, not a rushed transfer.

Users who received a Revolut notification should confirm it through the app’s support channel or by visiting Revolut directly instead of following links in an email or social-media post. They should ask which specific data fields were disclosed and retain a copy of the company’s response.

Users who have not received a notice do not need to move assets or assume that their information was exposed. They should monitor for an in-app message or notification through Revolut’s verified channels, review the security of their recovery email address and phone number, and remain alert to unsolicited messages mentioning crypto withdrawals or asking them to “secure” a wallet.

Changing a password can protect account access, but it cannot reverse the disclosure of identity information. The immediate priority is therefore to prevent impersonation rather than make an urgent transfer. Anyone concerned that identity-document data may be involved should treat unsolicited account-recovery, compliance and wallet-verification messages as high risk. No legitimate agent needs a seed phrase, password or one-time authentication code.

The European Data Protection Board lists fraud, identity theft and financial loss among the possible consequences of personal-data breaches.

The key unresolved issue is linkability. Revolut needs to explain whether the disclosed records included external wallet addresses, transaction identifiers or only internal account history. That information will determine whether affected customers face a conventional identity-fraud risk or a more durable connection between their real identities and publicly traceable Bitcoin activity.

The original report appeared on Coindoo. This article is for informational purposes only and does not constitute legal, financial or cybersecurity advice.