Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Currencies39240
Market Cap$ 2.70T+1.59%
24h Spot Volume$ 36.08B-9.08%
DominanceBTC56.63%-0.61%ETH11.01%+0.63%
ETH Gas0.05 Gwei
BlockchainSecurityHackCybercrime
Sep 17, 2026
2min read
byTokoni Uti
forBlockchainReporter
On September 16–17 the hacker group ‘iamnotavillain’ publicly demanded 6,000 XMR (about $3,000,000) in the privacy coin Monero from London fintech Revolut after a data breach that exposed identity documents for roughly 680 European customers and reportedly includes 147 GB of passports, driving licences and photos. Attackers used a compromised Italian institutional email to submit fake government requests, Italy’s anti‑mafia and prosecutors are investigating, and regulators in Italy and Lithuania have opened checks, highlighting <a href="https://xpertsstudio.com/fca-raids-illegal-p2p-crypto-trading-sites-in-london/” title=”FCA Raids Illegal P2P Crypto Trading Sites in London”>crypto security risks as Monero-based ransom demands complicate traceability and increase operational and reputational risk for fintechs.
See what traders are focused on
The hacker group calling itself “iamnotavillain” has publicly demanded a $3 million ransom in the privacy coin Monero from Revolut, threatening to sell stolen customer data within 24 hours if the London-based fintech does not pay The group posted the demand on a dark-web site on Wednesday, September 16, days after Revolut confirmed a breach that exposed identity documents belonging to roughly 680 European customers
How Attackers Reached Revolut’s Data
Attackers obtained the records using a compromised institutional email account belonging to the Reggio Calabria prefecture in Italy, letting them submit requests that appeared to come from a government body, Italian prosecutors said. Revolut confirmed the incident last week and said customer funds were not touched, though identity documents, birth dates and contact details were exposed. The company had earlier detailed the fake government request that compromised customer information, describing a sophisticated external impersonation scam. Investigators are still working to establish whether the institutional email account from which the requests originated was infiltrated or cloned, a measure of how carefully the operation was prepared.
A Public $3 Million Monero Demand
The group, which the Financial Times said it contacted via Telegram, asked Revolut to transfer “6,000 XMR / 3,000,000 $” or, in its words, “all the data will be sold and you will have blood on your hands.” XMR is the ticker for Monero, a privacy coin often used in illicit contexts because transactions are difficult to trace. The hackers claim to hold 147 gigabytes of data spanning passports, driving licences, identity documents and photographs, and threatened to sell the material to other criminal organisations if payment does not arrive within 24 hours. The Financial Times observed that publishing a ransom demand is unusual, since extortion attempts are normally made privately at first and only aired when a target refuses to negotiate.
Prosecutors and Regulators Respond
Italy’s National Anti-Mafia and Counter-Terrorism Directorate is working on the case, and prosecutors in Reggio Calabria are weighing an offence of intrusion into an IT system of public interest, Euronews reported. Investigators said the operation appeared to have lasted months and are still determining whether a computer at the prefecture or at Italy’s Interior Ministry was compromised. The Italian data protection authority has opened checks and contacted its counterpart in Lithuania, where Revolut’s registered office is located. The incident is the latest in a string of attacks that abuse government data requests to reach private customer records, alongside breaches such as a recent Trezor customer data exposure.
Source: cryptorank.io