Revolut Hackers Demand $3M Monero Ransom, Threaten to Sell Customer Data: Report

A criminal group calling itself iamnotavillain has posted a 24-hour ransom demand against Revolut, seeking 6,000 Monero (about $3 million) or it will sell hundreds of customers' identity documents and transaction records, the Financial Times reported. The group published the demand on a purpose-built website and warned that data would be sold if Revolut did not comply.

According to the FT, the attackers said they used blockchain analytics to identify Revolut customers whose on-chain activity suggested substantial crypto holdings, then focused their operation on those accounts. Blockchain investigator ZachXBT, who circulated a customer notification, said the breach appeared to be aimed at high-net-worth users, aligning with the group's account of its selection method.

Revolut has characterized the incident as stemming from a "sophisticated external impersonation scam," saying it provided data after receiving requests that came from a compromised Italian government email system and carried valid authentication. The FT reports those requests were made over several months. The stolen material shown to the FT reportedly included names, dates of birth, occupations, home addresses, copies of passports or driving licences, customer verification selfies, account statements with IBANs and wallet references, withdrawal records and full transaction histories.

Revolut told the FT it has not received any direct contact or demand from the individuals or group making the claims and described the number of affected customers as limited. The company also said funds and systems were untouched and declined to identify the government agency whose email domain was impersonated. The attackers' demand for payment in Monero — a privacy-focused coin that obfuscates transaction details and has been delisted by major exchanges such as Binance, Coinbase and Kraken — mirrors patterns noted by investigators who say extortionists sometimes prefer privacy coins even though many ransoms are still settled in Bitcoin.