Revolut Faces a 6,000 Monero Ransom Demand as Rival Groups Fight Over Its Customer Data Breach

Revolut Says It Has Heard Nothing Direct as a 6,000 Monero Ransom Demand Puts XMR Back in the Headlines

Revolut pushed back against the chaos surrounding its customer data breach on Thursday, saying it has received no direct contact from the group publicly demanding a ransom of 6,000 Monero, currently worth about 3 million USD, even as competing actors claim credit for the stolen records.

The fintech’s statement, delivered to Cointelegraph, is the latest twist in a saga that began when the company disclosed the breach last week. According to the Financial Times, a group calling itself IAmNotAVillain published an ultimatum within 24 hours of the disclosure, threatening to sell the customer records to other criminal organizations if Revolut did not pay. The choice of Monero, a privacy coin built to obscure sender, receiver and transaction amounts, is no accident: it remains the settlement asset of choice for extortion operations precisely because its ring signatures and stealth addresses frustrate chain analysis, in contrast to fully traceable chains where Bitcoin at 76,323 USD and Ether at 2,436 USD flows can be followed by analytics firms in near real time.

A Crowded Field of Claimants

The public ransom demand has become tangled in a dispute over who actually holds the data. An earlier group calling itself Revolut Smilik reportedly demanded 10,000 Bitcoin, a sum worth roughly 780 million USD at the time, an order of magnitude above the Monero ask now on the table. IAmNotAVillain fired back with a notice on its own website, iamnotavillain.xyz, alleging that a former associate had obtained only a small sample of the records before falsely claiming full credit. The site warned third parties not to deal with the rival claimant and was offline when checked by Cointelegraph at publication.

Cybersecurity-focused account Dark Web Informer flagged yet another domain, revoloot.lol, tied to a separate actor claiming responsibility, which was also unavailable. The result is a smokescreen: Revolut, Italian investigators and the customers whose data is exposed still cannot establish who controls the records, how much of the dataset is genuine, or whether any of the claimants are simply riding a high-profile incident for attention.

The Italy Connection

The breach carries a strange geopolitical hook. Italian authorities widened their investigation after reports that a government email account was allegedly used to obtain customer data. Italy’s National Anti-Mafia and Anti-Terrorism Directorate is now involved because the suspected intrusion concerns a government entity, according to the ANSA news agency. Prosecutors in Reggio Calabria opened a case into unauthorized access to a computer system of public interest, and investigators are working to determine whether the institutional mailbox was breached outright or cloned by attackers.

Italy’s privacy regulator has separately ordered banks to urgently review the security of their access systems and is examining whether other financial institutions may have been exposed to the same technique. The scenario, in which a single compromised government mailbox becomes the vector for a mega-breach at a private fintech, is the kind of supply-chain failure that compliance teams across Europe will be modeling for months.

Why the Monero Demand Matters for Markets

Extortion in XMR is routine in cybercrime, but the size and publicity of this demand landed during a notable rally for privacy assets. Monero was quoted near 502 USD on the day of the headlines, and the broader privacy coin sector has outperformed dramatically over the past year, with Glassnode data showing the category up triple digits since Bitcoin’s October 2025 peak. Every headline ransom denominated in Monero doubles as a stress test of the asset’s core thesis: that financial privacy remains a non-negotiable feature, regardless of exchange delistings in regulated markets.

For Revolut, the stakes extend beyond the ransom. The company, which recently secured a conditional United States banking charter and positions itself as a bridge between traditional banking and crypto services, now faces questions about how customer records were exfiltrated and why verification data proved vulnerable. European regulators under MiCA and the GDPR will expect a full accounting, and the Italian probe guarantees official scrutiny on both sides of the incident.

What Happens Next

The most likely path is an uncomfortable stalemate. Paying a publicly advertised ransom invites copycats, and Revolut’s statement that no direct contact has occurred suggests either that the claimants prefer spectacle to negotiation or that their channel to the company is broken. Data brokers may end up pricing the records regardless of whether the ultimatum is honored, which is why Italian banks are already being told to harden access controls.

For crypto observers, the episode is a reminder of the dual nature of privacy technology. The same properties that make Monero attractive to extortionists make it the only settlement asset that guarantees a victim of surveillance cannot be de-anonymized by analytics vendors. As regulators weigh the future of privacy coins in 2027, the Revolut breach will almost certainly surface in both columns of the debate: proof of criminal utility, and proof that in a world of permanent transaction surveillance, some demand for untraceable money will always find supply.

Revolut has not confirmed the size or scope of the stolen dataset, and customers continue to report phishing attempts exploiting the incident.