The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
Revolut Faces a 6,000 Monero Ransom Demand as Rival Groups Fight Over Its Customer Data Breach
Revolut Says It Has Heard Nothing Direct as a 6,000 Monero Ransom Demand Puts XMR Back in the Headlines
Revolut pushed back against the chaos surrounding its customer data breach on Thursday, saying it has received no direct contact from the group publicly demanding a ransom of 6,000 Monero, currently worth about 3 million USD, even as competing actors claim credit for the stolen records.
The fintech’s statement, delivered to Cointelegraph, is the latest twist in a saga that began when the company disclosed the breach last week. According to the Financial Times, a group calling itself IAmNotAVillain published an ultimatum within 24 hours of the disclosure, threatening to sell the customer records to other criminal organizations if Revolut did not pay. The choice of Monero, a privacy coin built to obscure sender, receiver and transaction amounts, is no accident: it remains the settlement asset of choice for extortion operations precisely because its ring signatures and stealth addresses frustrate chain analysis, in contrast to fully traceable chains where Bitcoin at 76,323 USD and Ether at 2,436 USD flows can be followed by analytics firms in near real time.
A Crowded Field of Claimants
The public ransom demand has become tangled in a dispute over who actually holds the data. An earlier group calling itself Revolut Smilik reportedly demanded 10,000 Bitcoin, a sum worth roughly 780 million USD at the time, an order of magnitude above the Monero ask now on the table. IAmNotAVillain fired back with a notice on its own website, iamnotavillain.xyz, alleging that a former associate had obtained only a small sample of the records before falsely claiming full credit. The site warned third parties not to deal with the rival claimant and was offline when checked by Cointelegraph at publication.
Cybersecurity-focused account Dark Web Informer flagged yet another domain, revoloot.lol, tied to a separate actor claiming responsibility, which was also unavailable. The result is a smokescreen: Revolut, Italian investigators and the customers whose data is exposed still cannot establish who controls the records, how much of the dataset is genuine, or whether any of the claimants are simply riding a high-profile incident for attention.
The Italy Connection
The breach carries a strange geopolitical hook. Italian authorities widened their investigation after reports that a government email account was allegedly used to obtain customer data. Italy’s National Anti-Mafia and Anti-Terrorism Directorate is now involved because the suspected intrusion concerns a government entity, according to the ANSA news agency. Prosecutors in Reggio Calabria opened a case into unauthorized access to a computer system of public interest, and investigators are working to determine whether the institutional mailbox was breached outright or cloned by attackers.
Italy’s privacy regulator has separately ordered banks to urgently review the security of their access systems and is examining whether other financial institutions may have been exposed to the same technique. The scenario, in which a single compromised government mailbox becomes the vector for a mega-breach at a private fintech, is the kind of supply-chain failure that compliance teams across Europe will be modeling for months.
Why the Monero Demand Matters for Markets
Extortion in XMR is routine in cybercrime, but the size and publicity of this demand landed during a notable rally for privacy assets. Monero was quoted near 502 USD on the day of the headlines, and the broader privacy coin sector has outperformed dramatically over the past year, with Glassnode data showing the category up triple digits since Bitcoin’s October 2025 peak. Every headline ransom denominated in Monero doubles as a stress test of the asset’s core thesis: that financial privacy remains a non-negotiable feature, regardless of exchange delistings in regulated markets.
For Revolut, the stakes extend beyond the ransom. The company, which recently secured a conditional United States banking charter and positions itself as a bridge between traditional banking and crypto services, now faces questions about how customer records were exfiltrated and why verification data proved vulnerable. European regulators under MiCA and the GDPR will expect a full accounting, and the Italian probe guarantees official scrutiny on both sides of the incident.
What Happens Next
The most likely path is an uncomfortable stalemate. Paying a publicly advertised ransom invites copycats, and Revolut’s statement that no direct contact has occurred suggests either that the claimants prefer spectacle to negotiation or that their channel to the company is broken. Data brokers may end up pricing the records regardless of whether the ultimatum is honored, which is why Italian banks are already being told to harden access controls.
For crypto observers, the episode is a reminder of the dual nature of privacy technology. The same properties that make Monero attractive to extortionists make it the only settlement asset that guarantees a victim of surveillance cannot be de-anonymized by analytics vendors. As regulators weigh the future of privacy coins in 2027, the Revolut breach will almost certainly surface in both columns of the debate: proof of criminal utility, and proof that in a world of permanent transaction surveillance, some demand for untraceable money will always find supply.
Revolut has not confirmed the size or scope of the stolen dataset, and customers continue to report phishing attempts exploiting the incident.
first group demands 10,000 BTC, then a rival undercuts to 6,000 XMR. ransom market has competition now, wild
780 million vs 3 million, somebody finally did the math on what revolut would actually pay
right, 10,000 BTC was never a serious ask. 6,000 XMR looks priced at actual revolut pain thresholds, someone ran the numbers on what a breach costs them
priced at pain threshold or not, paying one crew just invites the other. the entire reason you never negotiate with two rival claimants holding the same dataset
exactly, and the dataset loses value every day it sits unsold. revolut can literally run out the clock while the crews fight over credit
rival crews undercutting each other on a 3M usd demand, ransomware has price competition now lol
ransom crews undercutting each other lol. next they offer loyalty discounts and a satisfaction guarantee on your own data
satisfaction guarantee on stolen data lmao. the undercutting makes cold sense tho, 3M in XMR split three ways after a rival fight is worse than one fast solo payout
loyalty discounts lmao. at this rate a third crew shows up offering revolut a bundle deal on all their future breaches
a bundle deal on future breaches is unhinged but also plausible. two crews claiming one dataset means neither fully controls it, so revolut can stall both
rival gangs fighting over who gets credit for the hack while revolut says it heard nothing directly. absolute circus
circus is right. half these crews rebrand after every job, expect three more names claiming the breach by friday
6,000 XMR is around 3M usd. someone on the revolut security team is having the worst week of their career
No direct contact from the extortionists but the breach itself is confirmed. The data is circulating regardless of which group took it
of course they demand monero. BTC flows get traced in hours, XMR stays the settlement rail for extortion
every extortion demand denominated in monero is a free ad for XMR privacy. darkest possible business development channel
Free ad is right. Every analytics firm tracing BTC flows in real time just did Monero’s marketing better than any developer could.
the funniest part is revolut saying no direct contact. the ransom note is public, the data is shopping around, and the legal team is parsing the word direct
parsing the word direct is generous. the FT timeline says the ultimatum went public within 24h of disclosure, they knew it existed, they just never got an invoice
revolut says no direct contact but the FT says the ultimatum went up within 24h of disclosure. somebody is lying
or nobody is lying. IAmNotAVillain posted the ultimatum publicly and never DMd revolut. both can be true
both true and worse. even if IAmNotAVillain never DMs them, the dataset is already circulating to other crews. silence from revolut is a strategy, not an answer
or the ultimatum went to a drop inbox nobody at revolut watches. no direct contact is doing a lot of legal work in that sentence either way
everyone staring at the XMR angle is missing the real story, a dataset on 30M customers getting priced like a clearance item
6,000 XMR and two crews arguing over who actually owns the keys. revoluts play is obvious, wait until the rivals undercut each other into nothing