Revolut disclosed sensitive customer information after treating a phishing request as a legitimate communication from a government body, according to CryptoNinjas.

The exposed information reportedly included passport and driver’s license copies, verification selfies, complete Bitcoin transaction histories and home addresses. Blockchain investigator ZachXBT said the incident appeared limited in scale but may have targeted high-net-worth cryptocurrency users.

The incident received a user score of 8.7. It highlights the risks of relying on trust-based security checks when a request appears to come from an official government email address.

Revolut Treated Fraudulent Request as Official

A customer notice said Revolut received a request from a valid government body that purported to contain customer information. The request was sent from an unauthorized email address on the agency’s official domain, but it carried valid domain authentication credentials. Revolut therefore treated the communication as an authentic government request and disclosed customer information before discovering that it was fraudulent.

The disclosed data fell into several categories, including personal, contact, identity and financial information. According to the notice, this included customers’ full names, postal addresses, email addresses, dates of birth, occupations and telephone numbers.

Bitcoin Transaction Histories Among Exposed Data

The financial information is particularly significant for cryptocurrency users. Revolut said the disclosed documents contained account statements, IBANs, account status information, wallet reference numbers, withdrawal history and complete transaction records, including Bitcoin transactions.

The data also included identity documents and information intended to accompany photographs and copies of passports or driver’s licenses. Revolut specifically stated that biometric facial telemetry data was not included.

The disclosure could create a connection between real-world identities and cryptocurrency activity. Identity documents, addresses and telephone numbers are generally stored off-chain, while Bitcoin transactions are publicly recorded on-chain. That distinction means the incident concerned information held by a financial platform rather than a change to Bitcoin’s transaction records or network security.

ZachXBT Raises Possible Targeting Concern

ZachXBT drew broader attention to the incident in a community alert on Telegram. He said the number of affected users was likely limited, while suggesting that the incident appeared to target high-net-worth individuals.

For users with substantial Bitcoin activity in their Revolut accounts, combining transaction data with identification and location information could provide attackers with a detailed profile of their financial and on-chain history.

After discovering the fraud, Revolut informed the affected individuals. The company also said the incident was not linked to the theft of customers’ funds. The reported response therefore focused on exposure of account and identity information, while the available notice did not describe a loss of customer assets.

The case illustrates a form of cryptocurrency security risk that does not require an attacker to compromise a blockchain or obtain a private key. Access to off-chain information connecting a Bitcoin user with their activity can also create significant risks for Bitcoin holders.