Revolut Falls Victim: Fake Government Requests Expose Bitcoin Activity Logs
TechFlow reports that on September 12, according to CoinDesk, cryptocurrency services platform Revolut recently suffered a severe data security incident after an internal employee fell victim to a social engineering attack disguised as a government law enforcement agency.
In the incident, the attacker sent a forged official letter to Revolut, claiming to be conducting a criminal investigation and requesting the platform's assistance in retrieving transaction records and activity status for specific Bitcoin wallet addresses. Due to a failure to strictly enforce internal verification procedures, Revolut complied with the request without verifying the authenticity of the legal documents, directly disclosing users' "Bitcoin Activity Passports"—on-chain activity trails capable of reconstructing their complete financial profiles—to the impersonators, resulting in substantial privacy breaches.
The incident exposes procedural loopholes that centralized institutions face when handling non-standard regulatory requests, highlighting management vulnerabilities within the platform's sensitive data access approval processes.
