Fintech giant Revolut handed sensitive customer data, including passport copies and full Bitcoin transaction histories, to a malicious actor after falling for a fraudulent request disguised as a legitimate government inquiry.

According to a customer notification circulated by crypto investigator ZachXBT, Revolut received a request for customer information that appeared to come from a government agency, sent from an unauthorized email account using the agency’s official domain.

Because the message carried valid domain authentication credentials, Revolut fulfilled it in the belief it was genuine.

The exposed data was extensive. Per the notice, it spanned identity details such as full name, date of birth and occupation; contact information including postal address, email and phone number; and document and verification data, including a copy of the victim’s passport or driver’s license and the selfie provided for verification.

Most alarming for crypto holders, the financial data included account statements with IBAN and wallet reference numbers, withdrawal records and full transaction history, including Bitcoin. Revolut said no biometric facial telemetry data was involved.

A Revolut spokesperson confirmed the breach to TechCrunch, describing it as “a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.”

The company said a “limited” number of customers were affected, that it had blocked the email address and alerted the agency, law enforcement and regulators, and that its systems and customer funds were unaffected. Revolut declined to say how many people were hit or which agency was impersonated.

ZachXBT said the incident appeared to target high-net-worth users, a concern given the surge in violent “wrench attacks” against known crypto holders. The leak drew sharp criticism, with several users on social media arguing the episode shows know-your-customer rules have created risk without meaningful benefit.

The breach lands amid a rough stretch for firms holding crypto users’ personal data. Hardware wallet maker Trezor recently saw a support-vendor breach widen to expose tens of thousands more customers, while X appeared to suffer a data breach of its own that flooded users with password resets.

Revolut, which launched its euro-pegged EURR stablecoin this year, is currently weighing an IPO.