Revolut Hackers Demand 6,000 XMR ($3M) or They Sell 680 Crypto Customer Files

A hacker group calling itself iamnotavillain has issued a public countdown to Revolut, demanding 6,000 XMR, roughly $3 million, as a Monero ransom.

The group says it will sell stolen data on approximately 680 customer accounts to other criminal organizations if the payment is not made within 24 hours.

Ad

Ad

The Financial Times first reported the ultimatum on 16 September 2026.

Why Hackers Chose Monero, and What It Signals

The exposed files include passports, driving licenses, KYC selfies, IBANs, account statements, and Bitcoin transaction histories.

Revolut says funds, passwords, private keys, and full card details were not taken. Its systems remain operational.

Attackers did not breach Revolut’s core systems. Instead, they sent fraudulent data requests through a compromised Italian government email domain, a PEC mailbox that passed Revolut’s law-enforcement request checks.

A similar KYC pipeline attack hit payment processor Transak in 2024, when a ransomware group exposed 57,000 users’ selfies and identity documents, showing how KYC vendor workflows can become the attack surface.

The 680 accounts were not chosen at random. The group told the Financial Times it ran on-chain analysis to identify Revolut’s heaviest crypto users.

The tactic used, mirrors what happened at Coinbase earlier this year, when a contractor leak exposed high-profile executives including a top Sequoia Capital partner, proving that even a “limited” breach can target the most valuable accounts.

The choice of XMR is deliberate. Monero’s privacy architecture makes it nearly impossible for investigators to trace payments.

Earlier this year, a thief who stole $330 million in Bitcoin immediately swapped the funds into Monero to evade chain-analysis tools.

Selecting XMR as the Monero ransom currency here follows exactly that playbook: receive, disappear.

For the 680 affected users, the immediate risk is not a drained wallet. Revolut says private keys were untouched. The danger is physical.

Passport copies, KYC selfies, and crypto transaction records create the same exposure for Revolut’s named accounts.

Ad

Ad

A $75B Valuation Story Now Carries a Compliance Asterisk

Revolut says it has received no direct demand through any formal channel, a position that sidesteps a forced “we do not pay ransomware” statement.

For context, Coinbase refused a $20 million ransom after its contractor breach and instead bounced a reward to catch the attackers. Revolut has not announced a comparable package for affected customers.

The timing is painful for Revolut’s expansion narrative. The company secured a conditional OCC approval for a US national bank charter targeting a 2027 launch.

The Federal Reserve and FDIC approvals still lie ahead. A law-enforcement impersonation hole, sustained over multiple months, is precisely the “safety and soundness” anecdote US bank supervisors flag in fitness reviews.

In Europe, Revolut built its compliance credibility partly by delisting USDT across the EU ahead of MiCA’s stablecoin rules.

That positioned it as a regulation-first operator. A Monero ransom demand tied to a fraudulent law-enforcement pipeline cuts against that image, and arrives while the UK ICO is formally assessing the breach and the FCA is engaged.

Revolut’s balance sheet and customer funds are intact. Its law-enforcement request controls are not.

Until an independent scope confirms how long the Italian mailbox was active and how many requests passed through, this Monero ransom episode sits as a process-risk overlay on every pending license, not a $3 million cash event.

Compare the top cloud mining platforms by contract terms and payout reliability. The race for AI supremacy has spilled into prediction markets, where you can track Elon Musk’s AI model chances.