The Bitcoin Beacon
A spoofed request that cleared the bank’s checks exposed passports, addresses and full bitcoin histories — proof the honeypot was never the blockchain.
LONDON — A fraudulent request dressed up as a government demand slipped past Revolut’s security controls late Friday, and the digital bank handed over some of its customers’ most sensitive records — passports, home addresses and their full bitcoin transaction histories — before it realised the request was fake.
The bank disclosed the breach on Saturday in notices to affected users. It said no customer funds were lost, that it had notified regulators, and that it had blocked the source of the request. It has not said how many people were exposed.
The files reportedly included passports or driving licences, verification selfies, names, dates of birth, occupations, home addresses, emails, phone numbers, IBANs, account statements, withdrawal records and complete transaction histories — including every bitcoin movement in and out of the account. In other words, the exact dossier a bank assembles to satisfy know-your-customer rules.
The attack did not break any encryption or guess any password. It exploited authorisation. The request appeared to come from a real government agency and, according to Revolut’s notices, arrived from an unauthorised account using that agency’s genuine email domain — enough to pass the bank’s domain-authentication checks. Revolut released the data, then contacted the agency separately and learned the demand was never made.
Bitcoin’s ledger is public by design: every transaction is visible to anyone. What is not on the ledger is identity. A passport, a home address and an occupation live in a company’s database, not on the blockchain. A custodial intermediary is the one place those two datasets sit side by side. Breach it, and an anonymous string of on-chain payments becomes a map from a named person to every coin they have ever received or spent.
The honeypot was never the blockchain. It is the file the intermediary keeps beside it.
On-chain investigator ZachXBT, who first drew attention to the incident, said in a broadcast that the breach appeared limited in size and may have deliberately targeted high-net-worth users — the customers whose bitcoin histories are worth the most to an extortionist or a kidnapper. A leaked home address attached to a large, traceable balance is not an abstract privacy problem; it is a physical-security one.
What makes this breach unusual is the door the attackers walked through. They did not fight the bank’s defences; they impersonated the authority the bank is legally bound to obey. Banks receive genuine law-enforcement and regulatory data requests routinely and are obliged to answer them. Turning that obligation into an attack surface means the very machinery built for compliance — the duty to hand data to the state on demand — becomes the weapon. Revolut is regulated across the UK and EU and, as one of Europe’s largest digital banks with tens of millions of customers, sits under strict data-protection law; a confirmed leak of identity documents and financial records is the kind of event that draws regulators’ own scrutiny, not just their sympathy.
For bitcoin holders, the specifics are new but the shape is familiar. In 2020 a leak of Ledger’s customer database exposed hundreds of thousands of hardware-wallet buyers, and the fallout was not stolen coins but a wave of phishing and, for some, threats delivered to their homes. Only last week a vendor leak exposed tens of thousands of Trezor buyers to the same risk. In every case the bitcoin stayed put; what leaked was the link between a person and their holdings. That link is the asset attackers actually want, because it converts a public, pseudonymous ledger into a targeting list.
Impersonation is getting cheaper. Convincing emails, forged documents and plausible bureaucratic requests can now be produced at scale, while banks keep collecting ever more detailed records about who their customers are and how they move money. That combination — richer databases, easier forgery — is the structural problem the Revolut breach illustrates.
It also strengthens the case for a technical answer the bitcoin world has been building toward: proving a fact without surrendering the underlying data. Zero-knowledge systems can let a company demonstrate that an identity check was completed, or that a customer meets a requirement, without holding a permanent copy of the passport and address used to establish it. And, more bluntly, it is a reminder of why self-custody exists. Coins the bank never holds cannot be handed to anyone impersonating a bank.
Why it matters: the risk in bitcoin is rarely the chain itself — it is the intermediary that keeps your identity filed next to your balance.
Details of the exposed data and the nature of the request are per Revolut’s notices to affected customers as reported by CoinDesk and corroborating outlets, and observations by ZachXBT (Sept 12, 2026). Revolut has not disclosed the number of affected users. Informational only — not financial advice.
Free. Five minutes. No hype.
Subscribe free