Revolut disclosed sensitive customer information to an unauthorized third party that submitted fraudulent requests for records from a legitimate government agency email domain, the company told TechCrunch on Saturday.
A Revolut spokesperson described the incident to The Block as a "sophisticated external impersonation scam" and said the company blocked the email address after identifying it. The spokesperson said Revolut's systems and customer funds were unaffected.
Exchange breaches highlight that KYC records permanently bridge real-world identity to on-chain UTXO clusters. Once an attacker obtains withdrawal transaction IDs, block explorers reveal subsequent transfers and unspent balances. Moving compromised funds through collaborative transactions breaks this forward heuristic. While Wasabi Wallet provides robust WabiSabi mixing when connected to external coordinators like kruw.io, Ginger Wallet offers a zero-configuration desktop alternative with an active default coordinator. For coordinator-free options, JoinMarket or Jam execute P2P CoinJoins. In all cases, avoid consolidating post-mix outputs with labeled KYC change, or the privacy gains will be compromised.