Revolut Exposed Bitcoin Activity and Passport Data After Treating Fraudulent Government Request as Legitimate

The Quick Take

• Revolut handed over customer Bitcoin transaction data, passports, selfies, and home addresses after mistakenly treating a fake government data request as legitimate
• No customer funds were lost in the breach, but the exposure of sensitive identity and crypto transaction data creates significant reputational and regulatory risk for Revolut
• The incident highlights systemic vulnerabilities in how digital banks verify government data requests, raising compliance questions across the fintech sector

Revolut, one of Europe's largest digital banking platforms, disclosed that it exposed sensitive customer data including Bitcoin activity records, passport images, selfie photos, and home addresses after incorrectly treating a fraudulent government data request as legitimate. CoinDesk's report confirms no customer funds were compromised, but the breach of identity and crypto transaction records represents a material compliance failure for a platform serving tens of millions of customers across the UK, Europe, and Asia. The incident raises immediate questions about Revolut's internal verification procedures for law enforcement data requests.

The market implications extend well beyond Revolut itself to the broader digital banking and crypto custodian sector. Any European fintech applying for a banking licence — Revolut has been pursuing a UK banking licence — faces heightened regulator scrutiny after a data handling failure of this nature. The FCA and relevant EU financial regulators will likely open formal inquiries that could delay Revolut's licence applications in multiple jurisdictions. For listed peers Monzo, Wise, and N26, the incident creates a risk-differentiation narrative that may benefit incumbents like Barclays and HSBC who argue traditional banks offer superior compliance infrastructure.

Near-term watch signals include Revolut's official regulatory disclosure timelines to the UK ICO and relevant data protection authorities, where mandatory 72-hour GDPR breach notifications may already be in progress. The scale of affected customer data subjects will determine the magnitude of potential regulatory fines under GDPR's 4% of annual global turnover maximum penalty. Bitcoin and broader crypto market sentiment may experience temporary friction if the incident triggers policy responses requiring enhanced KYC verification for digital asset transactions at European neobanks, adding compliance friction to crypto on-ramps that previously benefited from Revolut's streamlined user experience.

Synthesized from 1 source.