Revolut data leak exposed KYC files of 680 VIP crypto clients, extortion demand hit 10,000 BTC

Revolut has now been tied to a data leak affecting 680 high-value clients who used the platform for crypto transactions. The part that matters for PSPs and compliance teams is not just the breach itself, but the attack path: the attackers used social engineering against the compliance function, posing as an Italian state entity to pull sender information.

1. The exposed group included former Mt. Gox CEO Mark Karpelès, German entrepreneur Felix Römer, and clients from the EU, with a focus on Switzerland and France. For high-risk payment and crypto businesses, that is the usual customer profile that gets extra scrutiny on paper and extra attention from attackers in practice.
2. The attackers reportedly studied transactions and then sent compliance requests while pretending to be a government body. That is a direct reminder that AML/KYC teams are not just data handlers; they are also an attack surface.
3. The extortion demand was 10,000 BTC, with a threat to publish the stolen data if the demand was not met. Part of the victims’ names became public only after a partial release of the stolen information.
4. The leak matters beyond Revolut itself because KYC records are a clean target list: names, transaction context, and client relationships are enough to turn a compliance dataset into a targeting tool. For neobanks and PSPs working in crypto, that is the practical risk — the record you collect for diligence can become the record criminals use for pressure.

For the industry, the uncomfortable takeaway is simple: a sophisticated fintech stack does not close off human social engineering, especially when the request is routed through compliance and framed as a state inquiry. If a platform handles crypto flows, the transaction trail can also make its clients easier to identify and target.