A group identifying as iamnotavillain has issued a ransom demand of 6,000 XMR, equivalent to $3 million, to the fintech company Revolut. The hackers set a 24-hour deadline, threatening to sell sensitive customer data if the payment is not made in the privacy-focused cryptocurrency Monero.
The breach involved the compromise of an Italian government email system, which the attackers used to send fraudulent information requests to Revolut. The company responded to these requests, believing them to be legitimate, which resulted in the exposure of data belonging to at least 680 accounts.
Exposed information includes names, home addresses, passport copies, selfies, and full transaction histories. Blockchain investigator ZachXBT noted that the attack specifically targeted high-net-worth users, whose accounts were identified through prior on-chain analysis of crypto holdings.
Revolut stated that it has not received any direct contact from the group and described the incident as a sophisticated external impersonation scam. The company confirmed that its internal systems and customer funds remain secure, characterizing the number of affected users as limited.
