Revolut Ghosted by Ransom Crew, Says $3M Monero Ultimatum Never Reached Inbox

Revolut said Thursday it had received no direct contact from a group publicly demanding roughly $3 million in Monero (XMR) over customer data, deepening confusion about who is actually behind the breach. The group "IAmNotAVillain" set a 24-hour public deadline and threatened to sell the records to other criminal groups, according to the Financial Times, which first reported the demand on Wednesday. "Revolut has not received any direct contact or demand from the individuals or group making these claims," a Revolut spokesperson told Cointelegraph. The $3 million demand was priced from a demand for 6,000 XMR.

The public ultimatum is the latest twist in a breach Revolut first disclosed last week, and Italian authorities are now widening their investigation into how a government email account was allegedly used to obtain customer data. The group's website, iamnotavillain.xyz, was unavailable when checked by Cointelegraph at the time of publication. A separate group calling itself "Revolut Smilik" earlier demanded 10,000 Bitcoin ($BTC), then worth about $780 million, well above IAmNotAVillain's $3 million XMR demand. IAmNotAVillain disputed that claim on its site, alleging a former associate had received only a small sample of the data before taking credit for the breach, and warned others not to deal with the rival claimant.

Cybersecurity account Dark Web Informer flagged another site, revoloot.lol, tied to a separate actor also claiming responsibility, and that site was also unavailable when checked. Italy's National Anti-Mafia and Anti-Terrorism Directorate is involved because the suspected intrusion concerns a government entity, ANSA reported Wednesday, and prosecutors in Reggio Calabria have opened an investigation into unauthorized access to a computer system of public interest. Investigators are working to determine whether the institutional email account was breached or cloned, while Italy's privacy regulator has separately asked banks to urgently review access security and is examining whether other financial institutions may have been affected.