XIYU.NEWS EVENTS

Revolut hackers demand $3 million in Monero, threaten to sell customer data

DevelopingCryptoSecurity incidentFirst tracked 2026-09-16Last changed 2026-09-17

Current outcome

A group calling itself 'iamnotavillain' has given Revolut 24 hours to pay 6,000 XMR (~$3 million) or it will sell customer identity documents and transaction records from at least 680 accounts; Revolut responded that it has received no direct contact or demand, called the number of affected customers 'limited,' said funds and systems were untouched, and the report says the data came via a compromised Italian government email system after attackers used blockchain analysis to target high-net-worth users.

Progress timeline

2 material updates
  1. #01
    Initial2026-09-16 19:07 · publication time

    Revolut hackers demand $3 million in Monero, threaten to sell customer data

    Hackers calling themselves 'iamnotavillain' are demanding $3 million in Monero within 24 hours from Revolut, threatening to sell stolen customer data from at least 680 accounts that reportedly includes identity documents and transaction histories.

    Source evidence: CoinDesk

  2. #02
    Response2026-09-17 12:53 · publication time

    Revolut Hackers Demand $3M Monero Ransom, Threaten to Sell Customer Data: Report

    Revolut said it has not received any direct contact or demand from the group, called the number of affected customers 'limited,' and said funds and systems were untouched; the report adds that data was obtained via a compromised Italian government email system using genuine domains and valid authentication over months, with attackers using blockchain analysis to target high-net-worth users and showing the FT a screen recording of files.

    State after update: A group calling itself 'iamnotavillain' has given Revolut 24 hours to pay 6,000 XMR (~$3 million) or it will sell customer identity documents and transaction records from at least 680 accounts; Revolut responded that it has received no direct contact or demand, called the number of affected customers 'limited,' said funds and systems were untouched, and the report says the data came via a compromised Italian government email system after attackers used blockchain analysis to target high-net-worth users.

    Source evidence: Decrypt

All events · Back to the feed

XIYU.NEWS APP

Install xiyu.news

Open in a standalone window, check for updates online and read saved pages offline.