As if you needed any further evidence that KYC is the illicit activity, here are two tweets about the recent Revolut hack -- the first is about how it was achieved and the second is about its scope. Even if we granted that KYC could exist, it is clear that governments are leaky seives and there is zero chance that they will be able to safely store the data they have access to.

Our investigations team at Duel is in contact with the Revolut hacker, and we've found out a lot more about how he did what he did.

• The hacker got access to government employee accounts using an infostealer. After gaining access to an employee's email, they would log in, add their own recovery email, start to log everything, and silently listen in.
• To not get caught, they would instantly delete any email sent that was not intended for the original employee. The inbox was checked 24/7 for any new response to the hacker's sent emails. Upon receiving one, the hacker would instantly download it as a .eml and delete it before the original employee noticed
• The hacker says that at first he used to forge court orders (presumably when targeting other companies), but quickly realised that this wouldn't work for Revolut. After some research, they decided the best entity to target was Revolut's Lithuania-based Revolut Bank UAB, which would respond to a European Investigation Order (as shown in the images).
• With this stolen email, the hacker sent one request, originally 5 months ago, attached below. Revolut believed it, thinking it was the Italian government, and complied with the order.
• From the hacked email, the hacker was able to control and end emails that looked like they genuinely came from multiple Italian government email addresses.
• The hacker continuously sent out requests over the course of 5 months. Not once did Revolut ask questions or not send over the information. In one incident, the hacker accidentally sent the wrong document. Instead of realising what was going on, Revolut's support guided them on what to change (shown in an image below)

We remain in contact with the hacker and we've requested exclusivity of information related to the story to be kept with Duel. We believe it is in the public's best interest for EVERY piece of information related to this to be released, so that the extent of Revolut's failure can be brought to light, as well as the sheer stupidity of the manner in which the KYC paradigm is currently conducted.

The Duel team hopes that Revolut will be held accountable for their lack of due diligence and betraying their customers in such a severe manner, especially given the breadth and depth of the breach. Lives are now at risk. I'm personal friends with one of the victims, and he'll probably have to move houses due to the continued (credible) kidnap threats.

We hope to soon release a much more detailed article with more information, emails, screenshots and more.

source

The scope of the Revolut data breach is stunning.

Hackers are confirmed to have bank statements spanning back YEARS, which can disclose a surprising amount of information about a person.

Taking the example of Felix Romer (this analysis has been posted with his consent), there's a lot to unpack.

The bank statements released by the hackers go from Jan 2024 all the way until July 2026. Firstly, you can establish all of the destinations Felix frequents: Malta, Dubai, London, Bangkok, and more. It's a complete travel pattern dox, showing every point and place you went to. From the stores and restaurants, you can triangulate people's real locations pretty easily.

Felix also has expenses out to Reputation Rhino (a reputation management company), large payments to his girlfriend, payments to a payment processor known for adult content, and a charge to "Face IQ" for a "facial attractiveness assessment." The point here is that everyone on the list will have their most intimate and secret purchases exposed.

The more normal purchases: tens of thousands to Cartier, Chopard, luxury spas and clinics, Bryan Johnson's Blueprint, fine dining... While not directly harmful, provide a treasure trove of data into Felix's lifestyle, location, and viability as a target for all sorts of schemes, both online and irl.

There's also payments to various people. His girlfriend and assistants, but also smaller payments to unknown women. While in Felix's case, there's nothing he wants to hide, this could be absolutely disastrous for other high net worth individuals, as it reveals all of their closest contacts. Their best employees, girlfriends, mistresses, family members they care about, all of those are seen through a rich person's payments.

So other than just someone's ID and address... Revolut has essentially leaked their closest people and closest ties, some intimate secrets, granular location data derivable through cross referencing the locations of purchases made, the ability to cross reference existing evidence or leads against confirmation from the bank statements, and various other known and unknown risks that will compound through the lives of these unfortunate individuals for many years to come.

It's staggering how negligent Revolut has been with this data, how they didn't disclose the breach immediately when they knew it had happened, the sheer scope of the danger they have put their customers and their customers' loved ones in, and also how little we still know.

source