Revolut Hackers Want 6,000 XMR or the Crypto Customer List Goes Up for Sale 💸

A group calling itself iamnotavillain is demanding 6,000 monero (XMR), roughly $3 million, from Revolut within 24 hours, threatening to sell stolen data on about 680 customer accounts to other criminal organizations if the fintech refuses to pay, the Financial Times reported. The attackers posted the demand Wednesday alongside a countdown clock and asked Revolut to send the funds in monero, a cryptocurrency designed to obscure transaction details.

The hackers told the FT they used blockchain analysis to identify Revolut customers with significant crypto holdings before selecting their targets. A 60-second screen recording they shared with the newspaper appeared to show passports, driving licences, know-your-customer photos, IBANs and transaction histories, including Bitcoin activity, taken from affected accounts. Revolut previously told CoinDesk that customer funds, passwords, private keys and full card details were not taken and that its systems remain operational.

The breach did not result from a direct intrusion into Revolut's core infrastructure. According to notices previously sent to affected customers and prior reporting, attackers posed as government officials and submitted information requests that passed Revolut's checks, leading the company to hand over customer records before the requests were identified as fraudulent. Revolut has said it blocked the address used in the requests and notified the relevant government agency, law enforcement and regulators.

The UK's Information Commissioner's Office is assessing the incident and the Financial Conduct Authority is engaged, according to reporting. The disclosure comes as Revolut pursues a U.S. bank charter. The hackers told the FT there had been no negotiations with Revolut at the time of publication, and Revolut did not respond to requests for comment.