Revolut Hackers Set 24-Hour Monero Timer: 6,000 XMR or 680 Crypto Customers Get Listed 🕒

A group calling itself "iamnotavillain" has demanded 6,000 XMR, roughly $3 million, from Revolut within 24 hours or it will sell data on approximately 680 customer accounts to other criminal organizations, the Financial Times reported Wednesday. The demand, posted on a website set up for the purpose, asks for "6,000 XMR / $3,000,000" and warns that otherwise "all the data will be sold, and the blood will be on your hands." The Financial Times first reported the ultimatum on 16 September 2026. Monero is a privacy coin that obfuscates sender, recipient and amount information using ring signatures and stealth addresses; it has been delisted by major crypto exchanges including Binance, Coinbase and Kraken. According to TRM Labs, extortion groups sometimes discount demands paid in monero, though most ransoms are still settled in bitcoin ($BTC), which the firm describes as "far easier to acquire, move, and convert at scale."

The hackers told the FT they chose their targets by running blockchain analysis to identify Revolut customers with significant crypto holdings, then focusing on those specific accounts. Exposed files include names, dates of birth, occupations, home addresses, passport or driving licence copies, KYC selfies, account statements with IBANs and wallet references, and full transaction histories. The group shared a 60-second screen recording with the FT showing samples of the data. Revolut said funds, passwords, private keys and full card details were not taken and that its systems remain operational.

Attackers did not breach Revolut's core systems. Instead, they sent fraudulent information requests from a compromised Italian government PEC email address that passed Revolut's authentication checks, and the company handed over the records before discovering the requests were fraudulent. Revolut previously told CoinDesk it blocked the address used in the requests and notified the relevant government agency, law enforcement and regulators, and has described the incident as "a sophisticated external impersonation scam." Blockchain investigator ZachXBT, who first circulated a customer notification, said the breach appeared "targeted at high net worth users," aligning with the group's account of how victims were selected.

The incident lands as Revolut pursues a US bank charter; the UK Information Commissioner's Office is assessing the breach and the Financial Conduct Authority is engaged. Revolut said on Wednesday evening it "has not received any direct contact or demand from the individuals or group making these claims," called the number of affected customers "limited" and said funds and systems were untouched. Revolut did not respond to CoinDesk's request for comment by publication, and the hackers told the FT there had been no negotiations at the time of publication.