CoinDesk: Bitcoin activity, passports reportedly exposed after Revolut error

Revolut, a digital bank, processed a fraudulent government request as legitimate and disclosed customer files, according to CoinDesk on Saturday. The released material included passports, selfies, home addresses and Bitcoin activity.

The firm stated on Saturday that no customer funds were lost during the incident. CoinDesk published the report at 10:11 UTC on September 12, 2026, citing the bank's own disclosure.

Fake government appeal

According to CoinDesk, an impostor posed as a government body. The request sought user records from Revolut. The digital bank received the message before the weekend.

Bank treated message as valid

Revolut processed the inquiry as authentic, per CoinDesk. Staff did not flag the appeal as fake. The institution later admitted the error in its statement.

Passports released to sender

Passports formed part of the transferred files, CoinDesk reported. The documents contained identity details of customers. The bank confirmed the disclosure on Saturday without naming the sender.

Selfies among handed data

Selfies were included in the released package, according to CoinDesk. The images showed account holders' faces. The firm said the transfer occurred after the fake plea was accepted.

Home addresses surrendered

Home addresses also left Revolut's control, per the publisher. The location data accompanied the other records. No explanation of the leak was given beyond the Saturday note.

Bitcoin activity exposed

Bitcoin activity stood within the exposed set, CoinDesk wrote. The crypto usage records related to client accounts. The publication noted the link on Saturday alongside the identity files.

Firm spoke on Saturday

The company issued its account on Saturday, according to CoinDesk. The timing matched the weekend disclosure. No earlier comment appeared in the report from the bank.

Funds remained safe

No customer funds were lost, the firm said Saturday per CoinDesk. Balances stayed untouched during the incident. The financial loss was limited to data only.

Verification breakdown

The event showed a breakdown in check procedures, CoinDesk implied through the facts. The bank accepted a false government note. Such failure allowed the handover of records.

Publisher covered the case

CoinDesk published the story at 10:11 UTC on Sept 12, 2026. The outlet named Bitcoin and passports in its headline. The report relied on the firm's statement for details.

Scope of records

The released material included three identity types, per CoinDesk. Passports, selfies and addresses were listed. Bitcoin activity completed the set of exposed items.

Nature of request

The appeal claimed government origin, according to CoinDesk. It was in fact fraudulent. Revolut missed the deception and complied with it.

Legitimacy mistake

Staff marked the message legitimate, the publisher reported. That label triggered the data release. The error went unnoticed until the later admission.

Customer identity at risk

Identity papers left secure storage, CoinDesk noted. Face images joined the files. Addresses exposed residents' whereabouts to the requester.

Crypto usage revealed

Bitcoin activity indicated transaction patterns, per CoinDesk. The records tied users to the asset. No fund movement resulted from the leak.

Statement contents

The Saturday note admitted the handover, according to CoinDesk. It specified no monetary loss. The firm described the request as fake in the text.

Timeline of events

The fake appeal arrived before Saturday, per the report. The bank reacted by sending files. The public learned on the weekend via CoinDesk.

Data handling failure

Revolut failed to authenticate the sender, CoinDesk indicated. The lapse led to disclosure. Standard checks appeared absent in the process.

Document categories

Passports prove national identity, the report implied by listing them. Selfies bind face to account. Addresses place users physically at a location.

Bitcoin linkage

The asset appeared in the leak, according to CoinDesk. Its activity logs were among records. This ties the case to crypto users specifically.

No broader loss

Only data left the bank, per CoinDesk. Funds stayed in accounts. The incident stopped at identity exposure and activity logs.

Summary of facts

CoinDesk reported a fake government ask. Revolut complied and released files. Saturday brought the confirmation from the firm.

Closing context

The case shows a digital bank erred, per the publisher. Bitcoin activity was part of the spill. Customer money survived the breach attempt.

What it means for the industry

The case demonstrates a digital bank released Bitcoin activity and identity documents after a verification failure, according to CoinDesk. The event underscores that crypto usage records can be swept into broad data disclosures when a bank errs. No sector-wide change is stated in the facts beyond this incident.

Key takeaways

• Revolut treated a fraudulent government request as legitimate, according to CoinDesk.
• Passports, selfies and home addresses were handed to the requester per the publisher.
• Bitcoin activity was among the exposed records, CoinDesk reported.
• The firm said Saturday that no customer funds were lost.
• CoinDesk published the report on September 12, 2026 at 10:11 UTC.

The incident remains tied to a single statement from the firm on Saturday, per CoinDesk. Watch for further updates from the digital bank on its verification steps. No fund loss was recorded in the disclosed facts.