Hassan Maishera
TL;DR
-
Revolut hackers are demanding 6,000 XMR, worth approximately $3 million.
-
The group threatened to sell the stolen information if Revolut did not pay within 24 hours.
-
At least 680 customer accounts were reportedly affected.
-
Exposed records may include identity documents, KYC photographs, and transaction histories.
Hackers behind a data breach affecting Revolut customers are demanding about $3 million in Monero, threatening to sell the stolen information to other criminal organizations if the company refuses to pay.
The group, which calls itself “iamnotavillain,” reportedly demanded 6,000 XMR and gave Revolut 24 hours to comply. Its announcement included a countdown clock.
At least 680 customer accounts were affected, although Revolut said its internal systems and customer funds remained secure.
Hackers Demand 6,000 XMR
The attackers selected Monero for the ransom payment, according to the Financial Times.
Monero is a privacy-focused cryptocurrency designed to conceal transaction information, including wallet addresses and transferred amounts.
These characteristics have made XMR more difficult to trace than transactions on transparent blockchains such as Bitcoin or Ethereum.
The hackers said there had been no negotiations with Revolut at the time of publication. It remains unclear whether Revolut intends to pay the ransom.
Security authorities generally warn that paying extortion demands does not guarantee that criminals will delete stolen information or refrain from selling it.
The group provided the Financial Times with a 60-second screen recording that appeared to demonstrate its access to customer records.
The material reportedly included passports, driving licences, photographs submitted for know-your-customer verification and transaction histories.
Such information could be used for identity theft, account takeover attempts, targeted phishing or fraudulent financial applications.
Affected customers should be particularly cautious about unexpected emails, calls or messages claiming to come from Revolut, government agencies or cryptocurrency services.
Crypto Holders Were Reportedly Targeted
The hackers told the Financial Times that they used blockchain analysis to identify Revolut customers believed to hold significant amounts of cryptocurrency.
Although public blockchains do not usually display legal names directly, transaction patterns and information connected to exchanges or financial accounts can sometimes be used to associate wallet activity with individuals.
The claim suggests the attackers may have targeted specific customers rather than collecting records indiscriminately.
The breach reportedly did not result from attackers penetrating Revolut’s technical systems.
Instead, the hackers allegedly impersonated government officials and submitted fraudulent requests for customer information. The requests passed Revolut’s verification procedures, causing the company to disclose customer records before discovering the deception.
The incident highlights the risk posed by social engineering, where attackers manipulate employees or institutional processes rather than exploiting software vulnerabilities.
Revolut Says Customer Funds Were Unaffected
Revolut previously said it blocked the address used to submit the fraudulent requests.
The company also notified the relevant government agency, law-enforcement authorities and regulators. It said its systems were not compromised and customer funds were unaffected.
However, the exposure of identity documents and financial histories may create continuing risks for affected users even if no money was stolen directly during the breach.
