Revolut Hackers Demand $3 Million in Monero After Customer Data Breach

TLDR

• Hackers calling themselves “iamnotavillain” demanded 6,000 Monero (worth ~$3 million) from Revolut within 24 hours
• At least 680 customer accounts were affected after fraudulent government requests passed Revolut’s security checks
• Stolen data includes passports, driving licences, identity photos, and full transaction histories
• The hackers used blockchain analysis to target customers with large crypto holdings
• Revolut says its systems and customer funds were not compromised

---

A group of hackers has demanded $3 million from Revolut after stealing customer data through a fake government request scam.

Revolut Hackers Demand $3 Million in Monero, Set 24-Hour Deadline

Hackers calling themselves “iamnotavillain” demanded 6,000 XMR, worth about $3 million, from Revolut and threatened to sell stolen customer data to other criminal groups unless paid within 24 hours. The breach… pic.twitter.com/AO742ZpipZ

— Wu Blockchain (@WuBlockchain) September 17, 2026

The group, which calls itself “iamnotavillain,” posted the demand on Wednesday alongside a countdown clock. They gave Revolut 24 hours to pay or threatened to sell the stolen records to other criminal groups.

The demand is for 6,000 Monero, a cryptocurrency designed to hide transaction details including the sender, recipient, and amount.

How the Breach Happened

The attackers did not hack Revolut’s systems directly. Instead, they posed as government officials and sent information requests using what appeared to be a legitimate government email domain.

The requests passed Revolut’s checks, and the company handed over customer records before realising they were fraudulent. Once discovered, Revolut blocked the email address and contacted law enforcement, regulators, and the relevant government agency.

At least 680 accounts were affected, though Revolut described it as a “very limited” portion of its customer base.

The stolen data is extensive. It includes full names, dates of birth, home addresses, email addresses, phone numbers, passports, driving licences, and selfies submitted for identity checks.

Account data was also taken, including bank account numbers, account-opening dates, transaction histories, and Bitcoin wallet reference numbers.

Revolut confirmed that private keys, passwords, security codes, and full payment card details were not among the exposed information.

Why Hackers Chose These Customers

The hackers told the Financial Times they used blockchain analysis to identify Revolut customers with large crypto holdings. On-chain investigator ZachXBT had previously suggested the breach involved high-net-worth users.

Public blockchains can reveal wallet balances, transaction histories, and transfers between addresses. When that data is matched with identity records held by a financial service, it can expose a person’s full crypto activity.

The disclosed Revolut records appear to contain both sides of that link, making the affected customers potentially more vulnerable to targeted scams.

Monero was chosen for the ransom because its privacy features make it harder for investigators to trace than Bitcoin or Ethereum.

The Financial Times reported no negotiations between Revolut and the hackers had taken place at the time of publication. Revolut has not confirmed whether it plans to respond to the demand.