Fnalysis.
Courtesy KYC
Revolut handed over passports, selfies and the complete bitcoin history of several high-net-worth clients to a scammer posing as a government agency
The neobank confirmed on September 11, 2026 that it handed over full client files after receiving a fraudulent request sent from a real, but compromised, government email address. Because the message passed all three standard email authenticity checks (SPF, DKIM and DMARC), Revolut's automated filters treated it as legitimate and released the files before verifying anything through any other channel.
The leaked data included full identity records, passports or ID cards, KYC verification selfies, IBANs, bank statements and the victims' full bitcoin transaction history. The breach came to light thanks to on-chain investigator ZachXBT. On social media, user murtaza summed up the industry's irony: after surviving leaks at Ledger, Trezor and Coldcard, and bribed staff at Coinbase, the last door in turned out to be a plain email with an official letterhead.
Source: CriptoNoticias →The industry's most sophisticated verification system, taken down by a sender with good institutional spelling.