Back Coindesk

Revolut hackers demand $3 million in Monero, threaten to sell customer data

Coindesk • September 16, 2026

The group gave Revolut 24 hours to pay and said it targeted customers with significant crypto holdings.

Hackers are demanding $3 million in monero (XMR) within 24 hours or threatening to sell stolen Revolut customer data to other criminal groups.

At least 680 customer accounts were affected, with exposed data reportedly including identity documents and transaction histories.

The hackers told the FT they used blockchain analysis to identify Revolut accounts with significant crypto holdings.

The hackers behind a data breach at Revolut are demanding $3 million worth of monero (XMR) within 24 hours, threatening to sell the stolen customer data to other criminal groups if the bank refuses to pay, according to the Financial Times.

The group, which calls itself “iamnotavillain,” posted the demand Wednesday alongside a countdown clock, the FT reported. It asked Revolut to send 6,000 XMR, a cryptocurrency designed to obscure transaction details.

At least 680 Revolut customer accounts were affected by the breach, according to the report.

The hackers told the FT they chose their targets using blockchain analysis to find Revolut accounts with significant crypto holdings.

The group sent the FT a 60-second screen recording that appeared to show some of the data it obtained. The video included passports, driving licences, photos used for know-your-customer checks and transaction histories, according to the newspaper.

The breach came after attackers posed as government officials and sent requests for information that passed Revolut’s checks. Revolut handed over customer records before discovering the requests were fraudulent, according to notices previously sent to affected customers.

1 Fed raises rates by 25 basis points in first hike since July 2023 2 hrs ago

2 Celsius sues BitMEX for $495 million over 2020 crash liquidations 3 hrs ago

3 U.S. House's tax committee advances crypto tax bill in wake of Clarity Act loss 4 hrs ago

4 Hamas military wing told donors to avoid sending crypto directly from Binance, DOJ filing shows 5 hrs ago

5 Crypto Long & Short: Six signs a crypto winter is ending 5 hrs ago

6 Payward plans to offer U.S. clients onchain perpetual futures on Hyperliquid 5 hrs ago

7 Blockchain finance platform Theo launches tokenized silver backed by $40 million in active leases 6 hrs ago

8 A LatAm telecom operator is putting part of its finances on Avalanche 6 hrs ago

9 A stolen coin can be returned. A leaked identity cannot. 7 hrs ago

10 Bitcoin Core 32 enters final testing with faster validation, fee changes and security fixes 8 hrs ago

The Definitive Stablecoin Landscape Series: Asia Pacific

As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.

Fed raises rates by 25 basis points in first hike since July 2023

Payward plans to offer U.S. clients onchain perpetual futures on Hyperliquid

Bitcoin traders brace for Fed hike, but a surprise hold could pose bigger risk

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Revolut Data Breach Linked to Compromised Italian Government Email A significant data breach at Revolut involved hackers impersonating Italian law enforcement to obtain sensitive customer information. The attackers exploited a compromised Italian government email account, specifically from the pec.interno.it domain, to submit fraudulent requests for data. Approximately 680 customers were affected, with data including identity documents, banking information, and transaction histories being exposed. Revolut confirmed that its systems were not breached and that the requests appeared legitimate due to the email domain's authenticity. The attackers, identified as the group 'IAmNotAVillain', claimed to have maintained access to the compromised email account for about six months. The incident raises serious concerns about the security of government email systems and the potential for similar attacks in the future. Revolut has since alerted affected customers and blocked the fraudulent email address. Investigations are ongoing, and the incident has drawn attention from various regulatory bodies. 42 sources 68

Revolut hackers demand $3 million in Monero, threaten to sell customer data

The full story

Extracted Entities

Attack Types (1)

Companies (1)