Revolut Handed Out Bitcoin Records to a Fake Agency — Receipts on a $115 Billion Trust Story

The customer notice Revolut sent on Friday is the exhibit, and it reads less like a hack than a receipt for a confidence game. Full names, dates of birth, passport and driving-licence copies, verification selfies, account statements with IBANs — and, listed alongside them, Bitcoin wallet reference numbers and complete transaction histories, explicitly including the Bitcoin trades. The bulk of that data was not stolen from inside Revolut's systems. The company handed it over itself, to someone who pretended to be a government agency.

Here is the sequence on-chain investigators and Revolut laid out. An unauthorized sender used a real government body's email domain — not a look-alike address — and the message carried valid domain-authentication credentials so it passed the checks a bank applies before it will even consider a request. Revolut says it answered under the reasonable belief the request was authentic. The on-chain investigator ZachXBT flagged the notice publicly and said the incident looked possibly aimed at high-net-worth users; no confirmed count of affected customers has been published.

Before going further, grade the claim, because the box it belongs in decides the whole read. This is not an internal breach, and Revolut's own notice does not document funds withdrawn, accounts compromised, private keys, passwords, or full card numbers going out. No one drained a hot wallet. What went out the door was the ledger of who customers are and what they hold: an identity file plus a crypto transaction history, delivered to a party that had convinced the gatekeeper it was the state.

That combination is the part worth a second look. A private key, handed over, means the money is gone and the damage is instantaneous. A wallet reference number plus a passport is the quieter, more useful kind of theft for whoever received it: it is a targeting kit. The victim is now named, has an address, holds bitcoin, and transacted at known times — a readymade subject for a follow-on "your account is at risk" call, which is exactly the scam vector police were already warning Revolut customers about this summer. The material loss is potential and downstream, not booked today.

Which brings the valuation into the frame. Revolut is not a public company; a retail investor cannot buy its stock on an exchange, only pre-IPO shares on secondary marketplaces that are largely gated to accredited investors. But its price tag is public enough to weigh the event against. In July 2026 a secondary share sale priced the company at about $115 billion, Europe's most valuable private firm and a figure more than double the $45 billion of two years earlier. Against the $2.3 billion pretax profit Revolut reported for 2025, on $6.0 billion of revenue up 46% that is roughly 50 times pretax earnings — a multiple that assumes the trust machine keeps compounding, and that an application to run as a US national bank lands cleanly.

Viewed that way, a data incident is not a profit-and-loss event at $115 billion; it is a strike against the one asset the valuation rests on. A bank's balance sheet holds deposits and loans. Its real asset is the belief that it protects both your money and the record of what you did with it. That is the "identity switch" most covenants in this story: before the notice, Revolut was a custodian of your crypto history; after it, a counterpart that has now, twice in this decade, been talked out of customer data. In September 2022 a phishing breach exposed the personal information of more than 50,000 users. This incident is smaller in name count but rarer in substance — the first in the record to hand over a crypto transaction history along with identity documents.

The honest reading, and the break condition, belong together. What is established is the disclosure itself, the mechanism, and the crypto-specific contents. What is not established is any confirmed injury from it. Undisclosed is not illegal, a mistake is not a compromise of systems, and one social-engineering win is not a pattern of broken custody — the safeguards to watch are the observable ones. Revolut's crypto services, separately registered with the UK regulator, live or die on exactly this kind of trust, and the crypto market backdrop — $77,000 bitcoin, a fear-and-greed index in greed territory — means customers are actively holding these records through the very channel that just leaked. The fact that would overturn the benign read is if affected users start reporting follow-on identity theft or targeted crypto phishing, or if a regulator in Britain or Lithuania converts this into a fine that survives. Until one of those appears, this is a reputation event at a trust-priced company: worth weighing for anyone holding secondary shares, worth a heavier discount for anyone who assumed the crypto records were guarded better than an ordinary password.