Revolut says no direct contact after $3M Monero ransom demand over 680 crypto files
By Crypto Wire
September 17, 2026
Revolut said Thursday it has received no direct contact from claimants behind a customer-data breach even as a group styling itself IAmNotAVillain posted a public countdown demanding 6,000 XMR (~$3 million) within 24 hours or it would sell records on about 680 accounts—per Cointelegraph, the Financial Times, and Irish Times coverage dated September 16–17. For Plain English Policy readers, the desk fact is process risk: attackers allegedly used a compromised Italian government PEC mailbox to pose as law enforcement and pull KYC files on heavy crypto users identified via on-chain analysis.
Revolut first disclosed the impersonation scam around September 12, saying it blocked the address and notified the relevant agency, law enforcement, and regulators. Reported exposures include passports, driving licenses, KYC selfies, IBANs, account statements, and Bitcoin transaction histories. The company says funds, passwords, private keys, and full card details were not taken and that systems remain operational—attribute that scope to Revolut’s public statements, not to independent forensic confirmation published here.
Competing extortion narratives muddy attribution. An earlier “Revolut Smilik” claim sought 10,000 BTC (~$780 million at the time). IAmNotAVillain disputed that figure as a former associate with only a sample. Dark Web Informer also flagged revoloot.lol as another claimant site; Cointelegraph found both claimant sites unavailable when checked. Revolut’s “no direct contact” line means the public Monero clock is pressure theater until a verified channel appears.
Italy’s National Anti-Mafia and Anti-Terrorism Directorate is involved because a government entity sits in the alleged path, ANSA reported. Reggio Calabria prosecutors opened an unauthorized-access probe into a computer system of public interest, asking whether the institutional mailbox was breached or cloned. Italy’s privacy regulator urged banks to review access-security systems and is checking whether other institutions were hit—policy spillover beyond one fintech brand into the wider European banking access stack.
For NFT collectors who keep fiat on-ramps at Revolut-style neobanks, the Plain English Policy read is not “your Bored Ape seed is gone.” It is that blockchain analytics can mark you as a high-value KYC target, and law-enforcement request pipelines can be socially engineered if a real government email channel is abused. Conditional OCC chatter for a U.S. national bank charter targeting 2027 makes the timing reputationally sharp; UK ICO assessment and FCA engagement are the regulatory tracks to watch, not NFT floor prices on any collection.
The targeting method matters as much as the Monero ask. Claimants told reporters they used on-chain analysis to pick Revolut accounts with significant crypto holdings—exactly the cohort that also tends to mint, bid, and settle NFT trades through the same fiat rails. That does not mean marketplace contracts were breached; it means identity packets attached to large crypto balances became the product for sale.
What Thursday’s file proves is narrow. Revolut publicly denies direct ransom contact while IAmNotAVillain demands 6,000 XMR over ~680 crypto-linked customer files allegedly sourced through Italian government-email impersonation, with Italian authorities widening the probe. What it does not prove is which claimant controls the full dataset, whether other banks were hit the same way, or that NFT marketplace keys were compromised. Watch Italian investigative findings, ICO/FCA actions, and any verified customer notice with scope numbers.
Context for collectors: KYC selfies and passport scans are the soft underbelly of crypto onboarding even when private keys stay offline on a hardware wallet. A Monero ultimatum aimed at a regulation-first neobank is a reminder that compliance rails can be attacked without cracking the wallet layer NFT traders obsess over day to day when bidding or listing.
For 8bitcrypto readers on September 17, the clean Policy line is Revolut facing a public Monero ransom clock with no direct contact—Italian government-email impersonation turning heavy crypto KYC into an extortion story.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
