Breaches

Revolut breach under scrutiny after UK knifepoint crypto robbery

A UK crypto trader robbed at knifepoint banks with Revolut. Hudson Rock suggests a link to its KYC data breach, but the connection is unproven.

Padlock graphic with the headline Revolut breach fears after crypto robbery

A UK crypto trader says he was tied up at knifepoint and robbed of roughly $800,000, and he banks with Revolut, whose customer identity files were handed to impostors last month. Threat intelligence firm Hudson Rock has raised a possible link between the two, though no evidence yet shows the robbers used the leaked data.

What happened

Late on Monday 12 October 2026, a crypto trader who posts on X under the name “Realist” described a night-time home invasion in the UK. He says intruders bound him with tape, held knives to his face and made him move his holdings. In his own account, around $720,000 came off a Ledger hardware wallet and about $40,000 from other wallets, and the robbers also took a Rolex and smashed his phone. The trader says police treated his home as a crime scene, but at the time of writing no UK force has published a statement, so the account rests on his posts and an on-chain trail.

Hudson Rock then suggested the attack was “potentially linked directly” to the Revolut breach, calling it the first such physical case. Its reasoning is simple: asked in a reply on X whether he used Revolut, the victim said yes. That is the whole of the public link. Nobody has shown that the attackers worked from Revolut records, and his public crypto profile could have drawn attention in other ways. Readers should treat the connection as a hypothesis, not a finding.

The breach behind the speculation is real and confirmed. In mid-September Revolut admitted that it had released sensitive customer information to an unauthorised third party who sent requests from a genuine government email domain. Revolut called it a “sophisticated external impersonation scam” and said its systems and customer funds were untouched. SecurityWeek understands around 680 customers were affected, reportedly people with large crypto holdings, and Revolut’s chief executive for Western Europe, Béatrice Cossa-Dumurgier, later told French broadcaster BFM TV that the bank would pay for replacement identity documents and would not pay any ransom.

The technical picture

No malware touched Revolut’s own platform. The attackers abused a legitimate process: a regulated bank’s duty to answer lawful requests from law enforcement.

According to research from Duel and Hudson Rock, a mailbox on pec.interno.it, a domain used by Italy’s Ministry of the Interior, was taken over using credentials harvested by infostealer malware. Hudson Rock says its database holds roughly 300 stolen credentials for that domain and assesses that the attacker probably bought existing logs rather than infecting staff directly. Because the messages came from a real government domain, they would have passed the usual email authentication checks.

The attacker told Duel that, once inside, they added a recovery address, watched the inbox, and deleted outgoing fraudulent messages and incoming replies so the real account holder would not notice. Requests were reportedly framed as European Investigation Orders and aimed at Revolut Bank UAB, the group’s Lithuania-based European bank. The hacker claims the scheme ran for five to six months and that, on one occasion, staff helped correct a badly prepared document instead of questioning it. None of this has been verified independently; it is the attacker’s version, and Revolut has not confirmed it.

What was disclosed is the worst possible bundle for physical targeting. Notifications seen by TechCrunch and The Register list passport or driving licence copies, verification selfies, birth dates, postal addresses, contact details, occupations, IBANs, account statements and full transaction histories, including Bitcoin activity. The dataset can tell a criminal who holds crypto, roughly how much, and where they live.

Extortion followed. People claiming responsibility posted samples on Telegram and, according to The Register, demanded 10,000 Bitcoin; a separate actor using the name IAmNotAVillain publicly asked for about $3 million, which Crowdfund Insider puts at roughly 6,000 Monero.

Timeline from infostealer-compromised government mailbox to the Revolut breach, extortion demand and the UK robbery report

Why it matters for UK organisations

Revolut is a British firm with a UK banking licence, and the route used against it is not unique to fintech. UK organisations that hold personal data field disclosure requests from police, councils, regulators and overseas authorities, often by email, and staff tend to treat an official domain as proof of authenticity. A hijacked government mailbox turns that habit into a weakness.

The second lesson is about consequences. Breach impact is still often described in terms of fraud and phishing. When the leaked records combine wealth indicators with home addresses, the risk becomes physical. Chainalysis figures cited by Cryptopolitan put physical wrench attacks at 46 globally between January and June 2026, and the UK has seen several violent crypto robberies and a kidnapping conviction this year. Whether or not this robbery is connected to Revolut, firms that hold data on high-net-worth customers should be modelling that harm.

Third, infostealers were again the first domino. Stolen partner credentials apparently beat a bank’s verification process, so the bodies allowed to ask you for data belong in your supply chain risk thinking.

Expert view

In my experience, the disclosure desk is one of the least tested parts of any organisation. When we run social engineering assessments, a confident request on official-looking letterhead often succeeds, and a request from a genuine domain would be harder still to challenge.

What troubles me most here is the reported duration. If requests really flowed for months, nobody was looking at the pattern: one requester, a steady stream of high-value targets, a skew towards crypto holders. That is a detection problem as much as a process one. Volume and targeting anomalies in disclosure logs should alert someone in the same way an odd login would.

I would also be careful not to overstate the robbery link. Hudson Rock sells infostealer intelligence, and its post promotes that. Still, the underlying point stands: a dataset of names, addresses and crypto balances is a target list, and it now sits outside Revolut’s control.

What to do now

  1. Verify every data request out of band. Confirm police and authority requests using contact details you already hold, not those in the message. A real domain is not proof of a real sender.
  2. Keep a register of approved requesters and require a second reviewer before releasing identity documents, selfies or full transaction histories.
  3. Monitor disclosure logs for patterns: repeat requesters, unusual volumes and requests that focus on wealthy or high-profile customers.
  4. Disclose the minimum. Release only the fields the legal instrument requires, and challenge broad requests.
  5. Treat infostealers as a top threat. Enforce MFA, block credential reuse, and watch for staff and partner credentials in infostealer feeds. This maps to the Cyber Essentials controls for malware protection and user access control.
  6. Reassess breach impact for datasets that link wealth to home addresses, and give affected customers practical personal safety advice, not just phishing warnings.
  7. Affected Revolut customers should claim replacement documents, expect targeted scams and stop advertising crypto holdings.

Bottom line

The robbery may or may not trace back to Revolut, and until police say more it should be treated as unproven. The breach itself needs no such caveat: requests from a genuine government domain persuaded a major bank to hand over identity files, reportedly on wealthy crypto customers. Any UK organisation that answers official data requests by email should test that process this month.

Sources

Related Posts