Revolut Faces Data Leak Allegations Targeting High-Net-Worth Users

The prominent fintech and cryptocurrency platform Revolut is currently under scrutiny following reports of a potential security breach involving sensitive customer data. According to findings published on September 11, 2026, by the renowned on-chain investigator ZachXBT, the company allegedly failed to identify fraudulent requests, leading to the exposure of Personally Identifiable Information (PII) for a specific subset of its user base. The leak is suspected to be a targeted operation focusing on individuals with significant asset holdings within the digital banking ecosystem.

Scope of the Leaked Personal Information

The investigation suggests that the breach was highly invasive, compromising both identity documents and financial records. The information allegedly accessed by unauthorized parties includes comprehensive datasets that could facilitate further identity theft or social engineering attacks.

• Identity Verification Data: Copies of passports, driver's licenses, and biometric verification selfies.
• Financial Records: International Bank Account Numbers (IBANs), detailed account statements, and withdrawal logs.
• Transaction History: Complete records of past movements, specifically including Bitcoin (BTC) transactions.
• Personal Contact Details: Full names, dates of birth, residential addresses, occupational data, email addresses, and phone numbers.

On-chain detectives often track these leaks by monitoring dark web forums and anomalous movements of funds linked to phishing campaigns.

Targeting High-Net-Worth Individuals

While the total number of affected users appears to be limited compared to Revolut's global customer base, ZachXBT noted that the breach appears to target high-net-worth individuals. This selective nature suggests that the attackers may have had prior knowledge of their targets' financial status. On September 11, several Revolut clients reported receiving official security alert emails from the company, confirming that their accounts may have been compromised due to the unauthorized access of their documentation.

Revolut is suspected of leaking some users' personally identifiable information (PII) due to its failure to identify a fraudulent request.

The incident raises concerns regarding the Know Your Customer (KYC) storage protocols used by major fintech firms that bridge the gap between traditional finance and the blockchain industry.

As of the current report, Revolut has not issued a broad public statement regarding the total number of victims, though the distribution of security alerts indicates an active internal investigation. Users are advised to monitor their cryptocurrency wallets and bank accounts for any suspicious activity, especially those who frequently engage in high-volume crypto-to-fiat transfers. This incident highlights the ongoing security risks associated with centralized storage of highly sensitive biometric and financial data in the digital age.