UpGate

Tag: Security & Hacks

  • Near Intents Recovers $3.8 Million After Security Incident

    Near Intents Recovers $3.8 Million After Security Incident

    Near Intents has recovered approximately $3.8 million in cryptocurrency following a security incident that disrupted its services earlier this week. The cross-chain swap service announced that the full amount was returned within a 48-hour period.

    Incident and Service Disruption
    The incident occurred on Thursday, stemming from a bug in Near Intents’ Omni deposit and withdrawal layer that interacted with its main smart contract. This vulnerability allowed an unauthorized party to drain funds, prompting Near Intents to halt its operations.

    Direct Response and Fund Recovery
    In response, the Near Intents team publicly stated they identified the party responsible and issued a 48-hour ultimatum for the return of the funds, threatening further action. The funds were returned in full on Friday, leading Near Intents to cease its investigation. Near Intents has stated that it reported the incident to law enforcement.

    Attacker’s Message and Context
    An on-chain message, shared by Near Intents CEO Alex Shevchenko on X, indicated that the individual responsible expressed remorse, stating, “We’ve returned all the funds, we were in the wrong.” The message also included a plea for the use of bug bounties instead of disrupting services.

    Blockchain sleuth ZachXBT reported that the funds were initially sent to KuCoin and subsequently bridged to Bitcoin. This incident follows a turbulent week for Near Intents, which also blocked a swap attempt valued at $50 million by a known attacker and saw the Bitwise spot NEAR ETF begin trading days after the incident. Near Intents has processed over $30 billion in swaps across 35 blockchains.

    Remaining Uncertainties
    While the incident was resolved quickly, uncertainties remain regarding the specific technical details of the bug and the precise methods of fund recovery beyond the ultimatum and the attacker’s on-chain communication. The identity of the attacker also remains unconfirmed by third parties.

    Near Intents has pledged to compensate users in full for any losses incurred during the service disruption.

    Why This Matters

    This update details a security incident where a bug in Near Intents’ Omni deposit and withdrawal layer interacting with its main smart contract allowed an unauthorized party to siphon approximately $3.8 million. The specific bug that was associated with the incident.

    Broader Context

    Near Intents is a cross-chain swap service.

  • Crypto Hacks Top $766M in September Amid Bitget, Liquid Losses

    Crypto Hacks Top $766M in September Amid Bitget, Liquid Losses

    Crypto Hacks Surge in September, Reaching $766 Million in Losses

    September witnessed a dramatic spike in cryptocurrency hacks, with 55 major incidents resulting in a staggering $766.49 million in losses, according to data compiled by PeckShield. This figure represents a colossal 462% increase compared to August’s losses of $136.3 million, with two significant breaches accounting for the vast majority of the September total.

    Bitget and Liquid Network Dominate September’s Losses

    The Bitget incident, with losses estimated at approximately $387 million, and the Liquid Network theft of around $320 million (of which $285 million has since been recovered), have emerged as the largest and second-largest crypto thefts of the year to date. These events have surpassed previous major exploits such as those involving Drift and KelpDAO/LayerZero. When these two major incidents are excluded, the remaining 53 hacks from September collectively amounted to approximately $59 million, less than half of the total losses recorded in August.

    Bitget Details Security Breach

    Bitget confirmed that its security systems detected unauthorized transfers from portions of its hot wallets on September 24 at 18:31 UTC. CEO Gracy Chen explained that an attacker gained access to a backend system within the wallet infrastructure, manipulated transaction data, and deceived the authorization process to release funds. Chen clarified that a compromise of private keys was ruled out and that the exchange’s cold wallets, which hold the majority of its assets, remained unaffected. Bitget intends to cover the losses from its User Protection Fund, which currently holds over $464 million. “We will not run away from this, and every dollar will be accounted for,” Chen stated on X.

    Liquid Network Suffers Major BTC Withdrawal

    The loss at Liquid Network occurred earlier in the month, on September 6, when individuals identified as purported white-hat hackers withdrew approximately 4,000 BTC from the Liquid Federation wallet. The withdrawal utilized the SideSwap peg-out authorization key, although Liquid emphasized that the key itself was not compromised. In communications with Blockstream, the hacker indicated a willingness to return the funds once all nodes were patched. However, Ledger CTO Charles Guillemet expressed skepticism, noting that legitimate security researchers typically do not drain a bridge and then request on-chain contact.

    North Korea-Linked Hackers Suspected in Laundering Efforts

    In an update on September 29, SlowMist reported that hackers believed to be linked to North Korea are laundering the stolen Bitget funds. Their alleged method involves pairing CoW Protocol orders with Chainflip deposit addresses, converting the proceeds to Bitcoin, and then employing CoinJoin to obscure transaction trails. Cos, SlowMist’s founder, argued that anti-money laundering checks are struggling to keep pace with automated scripts. Chainflip is reportedly attempting to block these fund flows and has rejected at least one deposit, though it refunded the money rather than freezing it.

    Other Notable September Exploits

    The remaining eight entries in PeckShield’s top 10 hacks for September ranged from $3.15 million to $7.81 million. The largest of these was a front-running incident involving the MEV bot “yoink,” which resulted in the return of the stolen assets. The Payment Processor V2, specifically the LimitBreak contract at the center of a white-hat rescue on September 25, accounted for $6.6 million in losses, with $3.4 million recovered. In that operation, security researcher Quit successfully moved 23,155 NFTs valued at nearly $6 million out of exposed wallets, though a separate exploit path left 660 WETH unrecovered.

  • Bitget Blames DeFi After $387.5M Hack, Praises NEAR Intents

    Bitget Blames DeFi After $387.5M Hack, Praises NEAR Intents

    Bitget Criticizes DeFi Protocols for Refusing to Aid in Stolen Fund Recovery

    Cryptocurrency exchange Bitget is still grappling with the aftermath of one of the year’s most significant security breaches, and it has issued a pointed message to certain segments of the decentralized finance (DeFi) world. The exchange contends that some DeFi protocols have been unwilling to assist in the recovery of stolen assets, with NEAR Intents, a cross-chain protocol, standing out as a notable exception.

    The Breach and Its Aftermath

    The incident occurred on September 24, 2026, when attackers siphoned approximately $387.5 million from Bitget’s hot and warm wallets. The theft affected multiple blockchain networks, including Ethereum, Tron, and the XRP Ledger. The attackers exploited a zero-day vulnerability in third-party security software, which granted them access to high-level credentials, enabling them to issue fraudulent withdrawal commands before erasing their digital tracks.

    Bitget CEO Gracy Chen confirmed that the exchange’s cold wallets and private keys remained secure throughout the event. Following the breach, Bitget temporarily suspended withdrawals, gradually restoring them on September 28. The exchange assured users that all losses would be fully compensated by its User Protection Fund, which held over $464 million prior to the incident.

    NEAR Intents’ Role in Recovery Efforts

    NEAR Intents reported that its SHIELD risk-intelligence system successfully identified and blocked over $50 million in illicit laundering attempts linked to the Bitget hack. While SHIELD managed to freeze $503,000 in transactions as they were in progress, an additional $166,000 had already slipped through before the system could fully intervene. Bitget had offered a 5% bounty for recovered funds, a reward that NEAR Intents ultimately waived.

    Stablecoin Issuers Step In

    Centralized stablecoin issuers also played a role in the recovery efforts. Tether and Circle collectively froze between $320,000 and $340,000 in funds associated with the stolen assets.

    Despite these interventions, the overall recovery rate is estimated to be a mere 0.2% of the total losses.

    A Divide in the DeFi Community

    Bitget’s criticism highlights a long-standing tension within the cryptocurrency space. The exchange’s stance is that refusing to act when stolen funds are identifiable constitutes a deliberate choice, effectively determining who can access and utilize network resources.

    The incident has intensified the debate surrounding how cross-chain protocols should respond to instances of stolen funds. NEAR Intents aligned itself with proactive intervention, while centralized stablecoin issuers like Tether and Circle have long possessed the built-in capability to freeze their tokens.

    Ongoing Investigations and Future Implications

    Attribution for the hack remains uncertain, with theories suggesting potential involvement by actors linked to North Korea. However, Bitget has not confirmed any specific affiliations, and investigations are ongoing.

    For Bitget customers, losses are being covered by the User Protection Fund, and withdrawal services have been progressively reinstated since September 28. The breach originated from a vulnerability in third-party software with privileged access, underscoring how a vendor’s security lapse can lead to substantial financial losses for other entities.

    With a recovery rate of approximately 0.2%, the limited success in asset recovery may prompt increased regulatory scrutiny into how these platforms manage illicit financial flows.

  • Hacker Moves 54 Million Stolen XRP; Potential Selling Pressure and Market Impact Remain Uncertain

    Hacker Moves 54 Million Stolen XRP; Potential Selling Pressure and Market Impact Remain Uncertain

    A hacker who previously stole approximately 103 million XRP from the cryptocurrency exchange Bitget has moved about 54 million of these funds across new addresses. This redistribution, occurring on Saturday by 12:41 UTC, is being monitored for potential future selling pressure on XRP, though the ultimate market impact remains uncertain.

    The movement involved three of the five wallets that initially held the stolen XRP. According to on-chain data, two wallets that each held 20 million XRP were reduced to approximately 23 XRP and 55 XRP, respectively. A third wallet’s holdings were decreased to about 5.8 million XRP. Roughly 49 million XRP remained across the original five accounts at the time of reporting.

    At the time of the report, XRP was trading around $1.47. The cryptocurrency saw a decrease of about 3% over the preceding 24 hours, but maintained a weekly gain of 3%. The market’s reaction suggests that the transfer is being viewed as a risk factor rather than a reported liquidation event, as the token has not experienced a significant price drop.

    Bitget has stated that its protection fund covers the loss incurred from the breach, and customer balances remain unaffected. The exchange has also provided a schedule for the resumption of withdrawals for various cryptocurrencies. Bitcoin withdrawals are set to resume on September 28, followed by Ethereum on September 29, USDT on September 30, and other tokens on October 2.

    The native status of XRP on the XRP Ledger presents a challenge. The XRP Ledger’s architecture means Ripple does not have a built-in mechanism to freeze native XRP held in wallets under an attacker’s control. This suggests that as long as the XRP remains in the hacker’s possession, it could potentially be spent, but this does not suggest a sale.

    The implications of this on-chain activity are still unfolding. If the remaining XRP is moved to a known exchange address or swapped for another asset, the likelihood of imminent sell pressure would increase. However, the actual impact on XRP’s price will depend on the available buy-side liquidity at that moment. If the tokens remain parked across private wallets, the movement itself does not suggest a sale, and the potential price impact remains theoretical.

    Key uncertainties persist regarding where the remaining approximately $75 million worth of XRP will ultimately land and whether the hacker will attempt to liquidate these funds. The market is closely watching for further developments, with the potential for future selling pressure being a primary concern, balanced against the current stability and the technical limitations of the XRP Ledger.

    Why This Matters

    The materials describe a narrow update: Following a breach where approximately 103 million XRP was stolen from Bitget, the hacker redistributed a portion of these funds (about 54 million XRP) across new addresses. Where the remaining approximately $75 million in XRP will ultimately land.

    Broader Context

    Source materials place the factual news in this context: The attacker behind Bitget’s $388 million news driver has moved about 54 million stolen XRP out of three of the five wallets that originally held the funds.

  • Bitget Hackers Move $83M XRP; XRPL Freeze Unsupportable, Ripple Powerless

    Bitget Hackers Move $83M XRP; XRPL Freeze Unsupportable, Ripple Powerless

    Hackers Move Over Half of Stolen XRP, XRPL’s Lack of Freeze Functionality Leaves Ripple Powerless

    Hackers involved in the Bitget exchange breach have significantly moved over half of the 103 million XRP tokens, valued at approximately $83 million, that were initially stolen. The XRP Ledger (XRPL), however, does not support a freeze function, leaving payment company Ripple unable to intervene.

    According to on-chain records from the XRP Ledger, approximately 54 million XRP, worth around $83 million, has been transferred out of five initial wallets controlled by the hackers. This represents more than half of the stolen XRP, with less than half of the compromised assets remaining accessible.

    Unlike stablecoins such as Circle’s USDC and Tether’s USDT, which can be frozen on their respective blockchains by blacklisting addresses, XRP, the native currency of the XRP Ledger, lacks this inherent freeze capability. While Ripple issues its own tokens on the chain, it does not possess control over transactions involving native XRP.

    This technical limitation means that as long as the XRP remains within wallets controlled by the hackers, there is no mechanism to prevent its movement or sale. Recovery efforts are contingent on the hackers transferring the XRP to an exchange that does support freeze functionality, allowing that exchange to restrict the account and block withdrawals.

    The pace of the hackers’ transfers notably accelerated on Saturday. At 04:32 UTC, the five wallets held approximately 70 million XRP. Eight hours later, this figure had dwindled to just 49 million XRP. The hackers have been observed distributing the funds across a larger number of wallets, with some transfers following routes previously utilized by the initial wallet.

    One attempted transfer of approximately 521,000 XRP failed due to insufficient balance in the originating account. Roughly an hour later, a second wallet sent the same amount to the same recipient, suggesting a deliberate fund allocation strategy rather than random activity.

    XRP was trading around $1.54 on Saturday, marking a roughly 4% decline over the preceding 24 hours, though it maintained a 9% gain for the week. At this price, the initially stolen 103 million XRP was valued at approximately $160 million, representing about 4% of XRP’s daily trading volume of around $4.4 billion.

    The actual impact on XRP’s price from a large-scale sell-off would depend on market depth. However, current transfer patterns suggest the hackers are prioritizing diversification and holding rather than immediate liquidation, potentially to avoid triggering significant market volatility associated with large sell orders.

    Bitget revised its total stolen amount to $387.5 million on Friday, an increase from the initial estimate of $350 million, to include assets stolen from the Zcash and TRON chains. The exchange confirmed these were all part of the same attack and not new incidents.

    Bitget reiterated that its protection fund will fully cover the losses, ensuring user funds remain unaffected. The planned phased resumption of withdrawals is as follows: Bitcoin on September 28, Ethereum on September 29, USDT on September 30, and other cryptocurrencies on October 2.

  • Bitget Restarts BTC, ETH, XRP Withdrawals, Offers 10% Bounty

    Bitget Restarts BTC, ETH, XRP Withdrawals, Offers 10% Bounty

    Bitget to Resume Crypto Withdrawals Following Security Breach

    Cryptocurrency exchange Bitget announced it will gradually reinstate withdrawal services starting September 28, following a significant security incident that led to a temporary suspension. The exchange confirmed that the vulnerability has been identified and addressed, with extensive security checks now nearing completion.

    Phased Reopening of Withdrawal Services

    Bitcoin withdrawals are scheduled to be the first to resume on September 28 at 08:00 UTC, operating on the native Bitcoin network. This will be followed by Ethereum withdrawals on September 29, which will be available across multiple networks including Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism. USDT withdrawals are slated to restart on September 30, supporting transactions on Ethereum, BSC, Solana, and Tron.

    The phased reopening will continue with other assets, including XRP, BNB, and AVAX, with their withdrawal services expected to be fully restored by October 2. Fiat currency and P2P services are also slated to return to normal operations on the same date.

    Asset Recovery Bounty Program Launched

    In conjunction with the resumption of withdrawal services, Bitget has introduced an Asset Recovery Bounty Program. This initiative aims to incentivize the community to assist in recovering the stolen funds, offering rewards of up to 10% of the recovered amount. Participants can earn a 5% reward for successfully freezing stolen funds and an additional 5% if those efforts lead to the full recovery of the assets.

    Details of the Security Incident

    The security breach, initially estimated to involve $351.6 million in assets, was later revised by Bitget to approximately $387.5 million. The updated figure includes assets from Zcash and TRON that were not accounted for in the initial assessment. Bitget CEO Gracy Chen emphasized that the temporary withdrawal pause was a precautionary security measure and did not impact users’ account balances.

    The exchange stated that the security issue has been resolved, preventing further unauthorized transfers. However, withdrawals were halted as an additional safeguard while the platform conducted a comprehensive security review. Crucially, deposit services and other exchange functionalities remained operational throughout the review period, as incoming deposits were not deemed a threat to the platform’s core systems.

    Community and Partner Support

    Bitget has acknowledged the swift actions of Circle and Tether, who have already frozen approximately $318,000 worth of USDT and USDC from an address linked to the attacker. Despite these efforts, a substantial amount of stolen assets remains under investigation. Data indicates that wallets associated with the attacker still hold over 63,000 ETH, valued at around $183 million, and more than 102 million XRP tokens, worth approximately $157.48 million, which are currently not frozen.

  • Bitget Resumes Withdrawals in Four Phases, Bitcoin First on 9/28

    Bitget Resumes Withdrawals in Four Phases, Bitcoin First on 9/28

    Bitget Resumes Withdrawals After Security Breach, Losses Covered by Protection Fund

    Cryptocurrency exchange Bitget announced that the vulnerability exploited in a recent security breach has been patched, and withdrawal services will be gradually reinstated in four phases. Bitcoin withdrawals were the first to resume, at 4:00 PM Taiwan time on September 28. Ethereum and USDT withdrawals followed on September 29 and 30, respectively, with other tokens, fiat currencies, and P2P services scheduled to be restored on October 2. Bitget stated that user balances remain unaffected, and the estimated $387.5 million in losses will be covered by its protection fund.

    Phased Withdrawal Restoration Underway

    Bitget announced early on September 26, Taiwan time, that the vulnerability involved in the security incident had been identified and fixed. The temporarily suspended withdrawal services will be restored in four stages. Bitcoin withdrawals were the first to be reactivated, commencing at 4:00 PM Taiwan time on Monday, September 28. The final phase, encompassing other tokens, fiat currencies, and P2P services, is slated for Friday, October 2, at the same time.

    The exchange clarified in its announcement that the suspension of withdrawals was a precautionary measure to complete a final round of security verification and was unrelated to the adequacy of user assets. User account balances are unaffected, and losses incurred from the incident will be absorbed by Bitget’s protection fund. Trading and deposit services continue to operate as normal. The announcement also confirmed that the situation is under control, with no further unauthorized transfers occurring. Bitget is continuing its investigation with assistance from Google-owned cybersecurity firm Mandiant and SlowMist.

    The official announcements, originally marked in UTC, translate to the following schedule in Taiwan time:

    The incident occurred at 2:31 AM Taiwan time on September 25, according to Bitget. This timeline indicates that Bitcoin withdrawals will have been suspended for approximately three and a half days before resuming, and all services will be fully restored in about seven and a half days. XRP is not included in the first three phases and will be reinstated along with other tokens on October 2. CEO Gracy Chen, in a post following a livestream on September 25, highlighted that XRP represented the single largest loss on a specific chain during the incident.

    Bitget emphasized that the phased restoration order is consistent for all users, with no priority list. Users are not required to take any prior action, as the withdrawal availability for each currency will be directly displayed on the platform. Gracy Chen is scheduled to host a livestream AMA at 3:30 PM Taiwan time on September 28, half an hour before Bitcoin withdrawals reopen, to provide details on the incident and the progress of the recovery.

    Prior to this schedule announcement, Gracy Chen had stated on September 25 that an announcement would be made once specific times were confirmed, avoiding commitments to unverified timelines. Another announcement from Bitget on the same day indicated that withdrawal schedules would be released by noon Taiwan time on September 26. The actual schedule was published at 3:55 AM Taiwan time on September 26, approximately eight hours ahead of the self-imposed deadline.

    On September 25, based on on-chain tracking, Bitget revised the estimated amount transferred to attacker addresses to approximately $387.5 million, an increase of about $35.9 million from the initial estimate of $351.6 million. This discrepancy is attributed to previously uncounted assets on the Zcash and TRON chains. Affected cryptocurrencies include XRP, ETH, USDT, ZEC, USDC, BNB, AVAX, and TRX, among others.

    According to Gracy Chen’s statement on September 25, Bitget’s protection fund exceeds $464 million and is held in publicly verifiable wallet addresses. The exchange also possesses over $1 billion in proprietary assets. Based on the revised loss figure, the protection fund is approximately $76.5 million greater than the losses, a reduction in buffer of about 30% compared to the initial estimate, where the difference was around $112 million.

    Bitget has also launched a bug bounty program, offering a 5% reward to individuals or organizations that assist in freezing or recovering the stolen assets, primarily through collaboration with LazarusBounty on Bybit. The announcement noted that some of the stolen assets have already been frozen with industry assistance.

    When will Bitget resume withdrawals?
    Bitget is restoring withdrawals in four phases. Bitcoin withdrawals resumed at 4:00 PM Taiwan time on September 28. Ethereum withdrawals followed on September 29, USDT on September 30, and other tokens, fiat currencies, and P2P services are scheduled to resume at 4:00 PM on October 2.

    Will user assets be affected by the Bitget hack?
    Bitget has stated that user account balances are unaffected, and the approximately $387.5 million in losses will be covered by the protection fund. CEO Gracy Chen indicated that the protection fund exceeds $464 million, with an additional over $1 billion in proprietary assets.

  • MEXC Security Report: Intercepted Funds Surge, Reserves Remain Strong Amidst Rising Industry Threats

    MEXC Security Report: Intercepted Funds Surge, Reserves Remain Strong Amidst Rising Industry Threats

    MEXC’s security report for July-August 2026 reveals a significant escalation in the interception of risk-related funds and sustained strength in asset reserve ratios, positioning the platform against a backdrop of increasing cryptocurrency industry-wide cyber threats. The report also details the expansion of its Futures Insurance Fund and provides context on the broader security landscape.

    Enhanced Fund Interception and Account Security
    During the July-August 2026 period, MEXC successfully intercepted approximately 38.66 million USDT in risk-related funds across 215 reports. This marks a substantial increase, with successfully intercepted cases up by approximately 2,971% and the value of intercepted funds by approximately 12,646% compared to the previous reporting period. Concurrently, MEXC identified and restricted 20,752 accounts linked to risk-related activities, an 118.03% rise from the prior period. The platform also facilitated the return of 602,225 USDT in misdirected assets, a 75.31% increase in such recoveries.

    Financial Stability: Reserves and Insurance Funds
    MEXC’s financial resilience is further underscored by its asset reserves and insurance fund. As of September 1, 2026, the Futures Insurance Fund balance reached 791,696,422 USDT, reflecting a 5.44% increase over the preceding period. This fund serves as a critical buffer against extreme market volatility by covering negative balances during liquidations, thereby mitigating the risk of auto-deleveraging.

    The report suggests that MEXC maintained reserve ratios exceeding 100% for its key assets: BTC at approximately 288%, ETH at 113%, USDT at 115%, and USDC at 114%. According to the proof of reserves disclosed for this period, users can verify their individual account balances via the Merkle Tree.

    To bolster user asset protection, MEXC’s Guardian Fund employs a dual-reserve strategy, utilizing USDT for immediate liquidity and BTC for long-term asset stability. The platform intends to expand this fund from its current $100 million to $500 million.

    Industry Security Landscape and Evolving Threats
    In parallel with MEXC’s internal security efforts, the broader cryptocurrency industry grappled with significant threats. The July-August 2026 period saw 184 reported security incidents, leading to approximately $535 million in losses. Phishing, fraud, endpoint, and supply-chain security incidents constituted roughly 48% of these total incidents. A notable trend highlighted is the increasing use of Artificial Intelligence (AI) by attackers to automate the creation of phishing content and malware, thereby enhancing attack efficiency.

    Commitment to Trust and Transparency
    MEXC CEO Vugar Usi emphasized that “trust is the true reserve currency of this industry” and stressed the importance of decisive action and verifiable proof in protecting user assets. He affirmed MEXC’s dedication to improving its capabilities in identifying and intercepting risk-related funds, fostering cross-platform cooperation, and aiding law enforcement in asset recovery. The bi-monthly security reports are presented as a cornerstone of this commitment to transparency and accountability.

    Founded in 2018, MEXC operates as a global multi-asset trading platform, offering access to a wide range of financial instruments across over 170 markets, with a focus on zero trading fees and deep liquidity.

    While MEXC has demonstrated enhanced fund interception capabilities and maintains robust asset reserves, certain uncertainties persist. These include the precise nature of all risk-related fund reports and the specific judicial freeze procedures involved. Further details on the breakdown of industry losses by incident type and the exact timeline for the Guardian Fund expansion were not provided in the report.

    Why This Matters

    The materials describe a narrow update: MEXC’s security report for July-August 2026 indicates the interception of approximately 38. The exact nature and origin of all 215 risk-related fund reports.

    Broader Context

    Source materials place the factual news in this context: MEXC is a pioneer in 0-fee digital asset trading.

  • Revolut Hackers Leak Client Data, Demand Bitcoin Ransom

    Revolut Hackers Leak Client Data, Demand Bitcoin Ransom

    Hackers Leak Revolut Customer Data, Demand 10,000 Bitcoin Ransom

    Attackers who successfully tricked financial technology firm Revolut into handing over customer records have published the personal data of high-profile clients over the weekend. The group is demanding a ransom of 10,000 Bitcoin, warning on September 14 that they would escalate the daily release of stolen information until the European fintech complies.

    Revolut confirmed on September 12 that an unauthorized party had impersonated a government agency. The attackers sent fraudulent requests for information using an email address from the agency’s legitimate domain, complete with valid technical authentication, which staff processed as a routine legal request.

    The data breach, as previously reported, includes the disclosure of passports, verification selfies, account statements, and IBANs, alongside names, dates of birth, and home addresses. A Revolut spokesperson stated the company “recently identified a sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information.”

    The group, identifying itself as Revolut Smilik, has posted client files across several Telegram channels. They have warned that they will “start releasing more and more data every day until Revolut pays for leaking their customers.”

    The leaked details posted by the hackers include information on several customers, such as tennis player Alexander Shevchenko and Gamdom CEO Felix Römer.

    The published material appears to contain data on prominent individuals, including company executives, sports professionals, and performing artists, according to The Register. The publication estimated the 10,000 Bitcoin ransom demand to be worth more than $782 million. Revolut has declined to comment on the ransom demand.

    The company stated that it blocked the unauthorized access upon detection and has alerted the relevant government agency, law enforcement, data protection, and financial regulators. Revolut also confirmed that its systems and customer funds remain unaffected. The firm indicated that a limited number of customers were impacted and that it has contacted them directly, without disclosing the exact number of affected individuals or naming the compromised agency.

    Earlier, Revolut had stated that the biometric facial data of affected customers was not compromised. On-chain investigator ZachXBT, who flagged the incident, suggested that the breach appeared limited in scope and concentrated on high-net-worth users, an assessment that Revolut and independent parties have not yet confirmed.

    Revolut offers customers the ability to buy and sell over 90 cryptocurrencies. The stolen files reportedly include some clients’ complete Bitcoin transaction histories. Similar data leaks have previously fueled targeted scams against cryptocurrency holders. For instance, criminals have used leaked order data to send convincing phishing emails to Ledger owners, exploiting a fabricated Ledger-Trezor merger to lure them to a fake website that harvested their recovery phrases.

    The Revolut demand represents another instance where customer data has been weaponized against crypto firms. This follows a similar incident involving Coinbase, where a ransom demand forced the exchange to disclose a breach affecting over 69,000 customers, exposed after overseas support agents were bribed to hand over their records.

  • Revolut Data Breach Exposes Passports, Bitcoin Histories

    Revolut Data Breach Exposes Passports, Bitcoin Histories

    Fintech Giant Revolut Compromised by Sophisticated Phishing Scam, Exposing Sensitive Customer Data

    Revolut, the prominent fintech firm, has disclosed a significant data breach that resulted in the exposure of sensitive customer information, including passport copies and detailed Bitcoin transaction histories. The breach occurred after the company fell victim to a fraudulent request disguised as a legitimate government inquiry.

    Details of the Breach

    According to a customer notification shared by crypto investigator ZachXBT, Revolut received a request for customer data that appeared to originate from a government agency. The request was sent from an unauthorized email account that had successfully spoofed the agency’s official domain. Crucially, the message included valid domain authentication credentials, leading Revolut to believe the request was genuine and proceed with fulfilling it.

    The compromised data is extensive, encompassing a wide range of personal and financial details. Affected customers had their full names, dates of birth, and occupations exposed. Contact information, including postal addresses, email addresses, and phone numbers, was also compromised. Furthermore, identity verification documents, such as copies of passports or driver’s licenses, and verification selfies were handed over.

    For cryptocurrency holders, the breach is particularly concerning as it includes financial data such as account statements with IBAN and wallet reference numbers, withdrawal records, and complete transaction histories, including Bitcoin transactions. Revolut has stated that no biometric facial telemetry data was involved in the incident.

    Revolut’s Response and Impact

    A spokesperson for Revolut confirmed the breach to TechCrunch, characterizing it as “a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.”

    The company indicated that a “limited” number of customers were affected. Revolut has since blocked the fraudulent email address and has alerted the relevant government agency, law enforcement, and regulatory bodies. The company maintained that its internal systems and customer funds remain unaffected. Revolut declined to specify the exact number of customers impacted or the identity of the government agency that was impersonated.

    Wider Implications and Industry Concerns

    ZachXBT suggested that the incident may have specifically targeted high-net-worth individuals, a development that raises concerns given the recent increase in violent “wrench attacks” against known cryptocurrency holders. The leak has drawn sharp criticism from users on social media, with many arguing that the episode highlights how know-your-customer (KYC) regulations may create risks without delivering commensurate benefits.

    One user, Marc Zeller, posted on social media platform X (formerly Twitter), “Woke up to all my data leaked by @Revolut. Sharp reminder that KYC hasn’t produced meaningful upside and has put many in harm’s way.”

    This breach occurs during a challenging period for companies that hold personal data of cryptocurrency users. Hardware wallet manufacturer Trezor recently experienced a support-vendor breach that exposed tens of thousands of additional customers. Separately, X (formerly Twitter) appeared to suffer its own data breach, which led to a flood of password reset requests for its users.

    Revolut, which launched its euro-pegged EURR stablecoin earlier this year, is reportedly considering an initial public offering (IPO).