Revolut Hackers Demand $3 Million in Monero, Threaten to Sell Customer Data

A recent data breach involving Revolut has taken a more serious turn, with an alleged hacking group reportedly demanding around $3 million in Monero (XMR) and threatening to sell stolen customer information to other criminals.

According to reports, the group has given Revolut a 24-hour deadline to pay the ransom. However, Revolut says it has not received a direct ransom demand from the attackers. The situation remains under investigation, with law enforcement and regulators involved.

The incident highlights a growing concern for both the fintech and cryptocurrency industries: customer data can become a target even when a company's core systems have not been directly compromised.

What Happened to Revolut?

Revolut confirmed earlier this month that sensitive customer information had been disclosed to an unauthorized third party after attackers used fraudulent requests that appeared to come from a legitimate government agency.

The company said the incident involved a very limited number of customers and that affected users had been notified. Revolut also reported the incident to the relevant authorities and introduced additional security measures.

According to reporting from the Financial Times, the attackers allegedly exploited an Italian government email system and impersonated law enforcement officials when requesting customer information from Revolut. The attackers reportedly focused on customers who held significant cryptocurrency assets.

This means the incident was not necessarily a traditional attack in which hackers broke directly into Revolut's main systems. Instead, the reported method involved social engineering and fraudulent data requests.

Hackers Demand $3 Million in Monero

The alleged attackers, identifying themselves as "iamnotavillain," are reportedly demanding around 6,000 Monero (XMR), worth approximately $3 million at the time of reporting.

They have threatened to sell the stolen customer information to other criminal groups if the ransom is not paid within 24 hours.

Monero is a privacy-focused cryptocurrency designed to provide stronger transaction privacy than many other major cryptocurrencies. That privacy feature has historically made XMR attractive in some illicit transactions, including ransom demands.

In this case, the choice of Monero adds another layer to an already complicated situation because the attackers are seeking payment in a cryptocurrency specifically known for its privacy features.

What Customer Information Was Exposed?

Reports indicate that the stolen information could include highly sensitive personal and financial records.

Depending on the affected customer, the data reportedly included information such as:

• Names and contact details
• Addresses
• Dates of birth
• Identity documents
• Passport or driving-license information
• Verification images or selfies
• Account information
• Transaction history

Some reports have also indicated that customers with significant cryptocurrency holdings were specifically targeted.

For crypto users, this type of information can be particularly sensitive. A combination of identity documents, contact information and knowledge of someone's cryptocurrency holdings could potentially make victims more attractive targets for further scams or social-engineering attacks.

Revolut Says Its Core Systems Were Not Hacked

One of the important distinctions in this story is how the data was obtained.

Revolut has said the incident involved fraudulent requests appearing to originate from a legitimate government agency email domain. The company has described the incident as unauthorized disclosure of customer information rather than a direct compromise of its core technology infrastructure.

That distinction matters because cybersecurity threats are not always about sophisticated malware or someone breaking through a company's firewall.

Sometimes, attackers attempt to exploit people, processes and trust.

A convincing-looking government request can potentially create a completely different security challenge from a conventional cyberattack.

Why Crypto Users Are Particularly Concerned

The incident is especially relevant to cryptocurrency users because the attackers reportedly targeted people with significant crypto holdings.

Unlike a traditional bank account, cryptocurrency ownership can sometimes be connected to publicly visible blockchain activity. While wallet addresses do not automatically reveal a person's identity, combining blockchain analysis with leaked personal information can potentially create a much clearer picture of someone's financial activity.

This creates an important security lesson for crypto users.

Protecting a wallet does not necessarily mean protecting everything around it.

Personal information, email accounts, phone numbers, identity documents and transaction records can also become valuable targets.

Why Are Hackers Asking for Monero?

The ransom demand also puts Monero in the spotlight.

Monero is a privacy-focused cryptocurrency that uses technologies designed to make transactions significantly harder to trace than transactions on transparent blockchains.

That privacy has legitimate uses, including financial privacy, but it has also attracted attention from criminals seeking payment methods that provide greater anonymity.

The reported Revolut ransom is therefore another example of how privacy-focused cryptocurrencies can become part of the cybersecurity and digital-extortion landscape.

Importantly, the use of Monero in a ransom demand does not mean that the cryptocurrency itself is responsible for the attack. The technology and its uses are separate from the actions of people who choose to misuse it.

Revolut Has Not Confirmed the Ransom Demand

There is still an important uncertainty surrounding the latest development.

Reuters reported that Revolut said it had not received any direct contact or ransom demand from the alleged attackers. This differs from reports that the hackers publicly posted a $3 million demand and threatened to sell the stolen information.

As a result, the ransom demand should currently be understood as a reported threat rather than a confirmed payment negotiation between Revolut and the attackers.

Authorities are continuing to investigate the broader data breach.

What This Means for the Crypto Industry

The Revolut incident is another reminder that cryptocurrency security goes beyond protecting private keys.

Crypto users often focus heavily on wallet security, hardware wallets and exchange security, but personal information can be just as important.

A leaked passport, phone number, home address or transaction history can potentially expose a person to phishing, identity theft and targeted social engineering.

For crypto investors and builders, basic security practices remain essential:

• Use strong and unique passwords.
• Enable multi-factor authentication.
• Be careful with unexpected emails and account requests.
• Avoid publicly sharing information about significant crypto holdings.
• Keep sensitive identity documents protected.
• Treat unexpected government or financial requests with caution.
• Separate public-facing crypto activity from personal information where practical.

The incident also shows why organizations handling financial data need strong verification processes when responding to sensitive information requests.

The Bigger Lesson: Data Is Becoming a Crypto Security Issue

Cryptocurrency security is often discussed in terms of hacks, stolen private keys and exchange breaches.

But the Revolut case shows another side of the problem.

Personal data can become a bridge between the digital and physical worlds.

If attackers know someone's identity, location and cryptocurrency holdings, the potential consequences can extend beyond online account theft.

That is why privacy and cybersecurity are becoming increasingly important parts of the broader Web3 ecosystem.

As blockchain adoption grows, protecting users will require more than securing the blockchain itself. Companies, exchanges, wallets and users will also need to think carefully about how personal information is collected, verified and stored.

Final Thoughts

The reported $3 million Monero ransom demand against Revolut adds another layer to an already serious customer-data breach. While the alleged attackers have threatened to sell sensitive information, Revolut says it has not received a direct ransom demand, and investigations into the incident are continuing.

For the crypto community, the situation is a reminder that security is not only about protecting your wallet or private keys. Personal information, transaction history and digital identity can also become valuable assets for attackers.

As cryptocurrency adoption continues to expand, platforms that make blockchain technology easier to access will also need to keep security and simplicity in focus.

Build on Solana With Solsmint

For creators and Web3 builders looking to launch their own token, Solsmint provides a simple way to get started on Solana without dealing with unnecessary technical complexity.

With Solsmint, users can create a Solana token for just 0.05 SOL and access essential tools for managing their token, including minting, burning and airdrops. The platform also makes it possible to add liquidity directly to Raydium, helping builders move from token creation toward launching their project.

Solsmint is designed to be easy to use, whether you're creating a memecoin, launching a community token or experimenting with a new Web3 idea. The platform also supports NFT creation with 0 platform fees.

In a rapidly evolving crypto ecosystem, having simple tools can make it easier for builders to turn an idea into an on-chain project.

Create your token, manage your assets and start building on Solana with Solsmint.