KYC Is Working Exactly As Designed

For some wealthy Revolut crypto customers, a living nightmare began last week when a hacker leaked all their personal details online.

And the most shocking part of this story is how the hacker obtained the data in the first place.

By hijacking an official government email channel, they were able to request all the personal data of 680+ high-net-worth customers, including passport copies, facial scans, bank account numbers, tax numbers and more.

And Revolut, as it turns out, was more than happy to oblige them.

Credit: https://x.com/boldleonidas

But why would Revolut willingly hand over all that data to hackers, you might ask?

The answer reveals something far more sinister about this incident than first appears: the hackers never had to breach any of Revolut’s systems.

They were invited in through the front door.

They simply targeted the weakest link, which was the Italian government's internal email system.

And with official email addresses at their disposal, all they had to do was pose as law enforcement agencies - and Revolut just about fell over itself to comply.

‍

How a Few Emails Beat All Revolut’s Security

Revolut is a rapidly growing international ‘Neo-bank’ with approximately 70 million customers worldwide.

And while this breach affected a relatively small number of those customers, it turns out that this was no minor issue.

Once the hackers had obtained access to the Italian law enforcement’s email channel, all they had to do was email Revolut and request the data using something called an ‘European Investigation Order’ (EIO).

An EIO is used to gather evidence in a criminal case, and must be ordered by a judge, court or prosecutor.

However, this case has demonstrated that EIOs can be faked by hackers with access to the right government channels.

Unless the recipient of the EIO checks that the request is genuine, they can end up handing your data over to bad actors.

And this is precisely what happened. Revolut failed to perform any additional checks with the agencies that they believed were sending the requests.

Over a period of months, they not only handed over all the requested customer data, but also helped the hackers by showing them how to fill out the requisite forms correctly!

‍

But How Did The Hackers Know WHO to Target?

This begs the question – how did the hackers target these high net worth Revolut customers, and specifically those that held crypto?

The hackers didn’t actually know who was a Revolut customer, or how much money they held. They probably targeted large transactions coming in and out of Revolut’s consolidation wallets, which is not difficult to identify using chain analysis.

While the blockchain data doesn’t tell them WHO owns those assets, all the hackers had to do was grab the public transaction ID and then send an email to Revolut with that ID, requesting all the personal data of the owner.

Using this ‘spray and pray’ approach, they submitted hundreds of EIOs. Revolut didn’t raise a single eyebrow until a full five months into the scam, when they finally realised they’d been supplying customer data to an unknown third party.

‍

Why Do Attackers Have The Upper Hand?

AI has fundamentally changed the cybersecurity landscape. There is an imbalance of incentives: hackers are willing to spend a lot of money on computing power because the payoffs can be huge.

Meanwhile, government agencies do not have the same sort of incentives.

Their job should be to protect the sensitive data that they collect, against potential attackers.

However, it is getting increasingly expensive to do so, and the need to stay within allocated budgets means there is simply not enough incentive to strengthen defences against bad actors.

‍

This Was Not the First Breach For Revolut

The Revolut data breach was not the company's first privacy misstep. In 2022, the data of more than 50,000 customers was leaked after a social engineering scam allowed a third party access to their internal systems.

As a result, Revolut was investigated for possible violations of the EU’s comprehensive data protection regulation, but no outcome of the investigation was ever reported publicly.

Banks, tech companies and government institutions already have a long and checkered history of putting people at risk by leaking - or actively sharing - their data.

In 2022, Apple, Meta, and Discord all handed over data to hackers using forged Emergency Data Requests.

In 2024, a French tax official allegedly stole and sold dossiers on high-net-worth crypto holders; France subsequently saw a surge in physical attacks on crypto holders.

In 2025, some Coinbase support agents were bribed to hand over customer data, which was then used in an attempt to hold Coinbase to ransom to the tune of $20M.

Most recently, in August, an identity verification platform called IDscan.net suffered a breach that leaked 153 million US and Canadian driver's licenses, plus millions of other ID cards and documents.

‍

Why is There So Much Data to Leak?

The list of hacks, breaches, and data leaks that have compromised people's personal data is extensive and growing.

But what exactly is creating this problem?

In a world where bad actors can leverage AI, it is all but inevitable that they will gain unauthorised access to data.

But why are there so many records to leak in the first place?

And that brings us to KYC, or ‘Know Your Customer’.

The term ‘Know Your Customer’ has a benign, almost friendly-sounding ring to it. But it is anything but benign.

KYC procedures have become so ubiquitous that most people can’t remember a time when they weren’t required to hand over everything except a blood sample and their firstborn child to open any type of account.

Rest assured, when our grandparents visited their local bank branch, there were no facial scans, proof of address, Tax Identification Numbers, digital passport and ID copies, or intrusive questions about their net worth, their income, and how they intended to use their own money.

‍

Is KYC Really Designed For Your Safety?

In today’s digital world, collecting, storing and sharing large amounts of personal data has become relatively trivial.

Paired with the increasingly burdensome regulations placed on banks and other financial institutions - such as international AML laws, FATCA and DAC8 - any notions of personal privacy are straight out the window.

And these laws are always promulgated under the guise of protecting us against money laundering and terrorism.

'It’s to prevent crime'  is the common catchcry of the KYC proponents.

Yet concrete numbers on how much crime excessive KYC requirements have prevented remain elusive.

KYC, however, does provide a useful tool of surveillance of the broader population. Sooner or later, everyone hands over their personal data in exchange for the privilege of opening a bank account.

‍

From ‘Know Your Customer’ to ‘Kill Your Customer’

Storing all this personal data is one thing. But as we've seen in previous incidents, protecting it properly is another matter entirely.

Large amounts of centralised customer data, often extending into millions of records, create very attractive honeypots for hackers.

And when a bad actor gets hold of your data, they can use it in ways that compromise your personal safety.

No doubt the customers involved in the most recent Revolut breach had to make rapid changes to their personal security.

Not only were they publicly outed as being high-net-worth individuals, but any bad actor can now find out exactly where they live.

So ‘Know Your Customer’ can quickly become ‘Kill Your Customer’.

‍

It’s About to Get Much Worse

This problem is only going to get worse.

New regulations like the EU’s DAC8 data-sharing laws, aimed at all licensed CASPs (Crypto Asset Service Providers), create multiple points of failure.

A CASP will share all your data with the local tax authorities in the country where it is registered, and that data will then be shared with all resident tax authorities. This all happens automatically - there are no data requests needed.

So what are some simple steps you can take to reduce the likelihood of getting caught up in a data leak?

‍

Damage Control: Limit Your Exposure

For most people, this problem is best addressed through damage control.

If you already have bank accounts, brokerage accounts, exchange accounts, or a tax identification number, your data almost certainly exists in large centralized databases.

And there is a greater-than-zero chance that some of your data has already been leaked.

You cannot reduce the probability of a data breach occurring. You can only limit the future likelihood that your personal data will fall into the hands of a bad actor.

The first - and most impactful - thing you can do is to stop signing up for any additional platforms that ask for KYC information. Don’t go and register yourself on every crypto casino out there.

If you must, be very deliberate about what you sign up for.

If you want to use an exchange, choose wisely. Check which personal data they collect before you sign up. Some exchanges collect more than others. Where possible, stick with non-custodial, Bitcoin-only exchanges.

Consider using Bitcoin as peer-to-peer money to avoid middlemen.

Wherever possible, spend directly in Bitcoin, and exchange it with peers. After all, Bitcoin was designed to be peer-to-peer electronic money.

If you run a plug-and-play node like Start9, it’s easy to use self-hosted P2P software like Bisq or RoboSats.

If you are signed up on platforms that you no longer use, consider closing your accounts.

Financial institutions are required to hold your data for a period of time after an account is closed, so this isn't an instant fix. However, after a certain number of years have elapsed, you should no longer exist as a customer in their system.

Make sure you maintain good Bitcoin address hygiene.

For example, if you withdraw Bitcoin from an exchange to a self-hosted address, that address can be recorded against your name.

Now imagine that the exchange leaked your data, including that address.

If you don't use a new address every time you receive a payment, you accidentally consolidate a UTXO from that address with multiple other addresses, or mix coins from KYC and non-KYC sources, you could share far more information about your Bitcoin holdings than you ever intended.

Remember that KYC is not a feature of Bitcoin - it is only a requirement for intermediaries.

And the fewer intermediaries you share your data with, the less likely you are to have your privacy compromised in a breach.

If you want to learn how to take full self-custody of your Bitcoin and protect your privacy and cybersecurity, get in touch with our expert team at The Bitcoin Way today.

We can help you set up fully sovereign Bitcoin self-custody, and we will never require any KYC or identifying information from you. Your privacy is always fully protected when you work with us.