Revolut Hackers Demand $3 Million in Monero, Set 24-Hour…

A hacking group calling itself "iamnotavillain" has issued a public ultimatum to Revolut, demanding roughly $3 million in the privacy coin Monero and giving the fintech a 24-hour deadline. The demand, equivalent to about 6,000 XMR, appeared on a website alongside a countdown clock on 16 September, according to the Financial Times.

Revolut told Reuters it had not been contacted directly and had received no ransom demand from those claiming responsibility. The attackers likewise told the FT that no negotiations with the company had taken place — leaving the $3 million figure as a public claim by the threat actor rather than evidence of an active extortion negotiation.

Fraudulent government requests

According to Revolut, the incident did not involve hackers breaking into its banking systems. Instead, the company confirmed on 12 September that it handed customer information to an unauthorised third party after receiving fraudulent requests that appeared to come from a legitimate government agency email domain. Revolut blocked the address and alerted law enforcement, financial regulators and data-protection authorities.

The attackers say they compromised an Italian government email system and impersonated law enforcement officials while requesting records over several months. The FT reported that the group supplied evidence appearing to corroborate parts of that account, though authorities have not publicly verified the claims. Around 680 customers are understood to be affected.

Exposed data reportedly includes passports and driving licences, identity-verification photographs, addresses, contact details, bank information, account statements and transaction histories. The attackers said they used blockchain analysis to single out customers with large cryptocurrency holdings. Most affected customers were based in Switzerland and France, with others spread across more than 30 European countries.

The choice of Monero is significant because its blockchain is built to obscure transaction details that are publicly visible on networks such as Bitcoin. The demand also differs sharply from an earlier online claim for 10,000 Bitcoin, worth hundreds of millions of dollars. The iamnotavillain group disputes that figure, saying another party with access to a sample of the data falsely claimed responsibility. Neither ransom amount has been independently validated by Revolut.

Revolut maintains that its core infrastructure, databases and customer accounts were not hacked, and that customer funds are unaffected; affected customers have been contacted directly and are receiving support. The UK Information Commissioner's Office has received a report and is assessing the breach, while the Financial Conduct Authority is engaging with the company.