Revolut confirms data breach exposing passports and Bitcoin records

Revolut has confirmed a data breach that exposed passports, selfies, and financial records after fraudsters impersonated a government agency using a spoofed but authenticated email domain. The incident, disclosed on September 12, has reignited a familiar debate in fintech: whether a ZK KYC data breach risk — meaning the exposure a Zero-Knowledge approach to identity checks could have prevented — shows a better path than the centralized identity files banks rely on today.

Key takeaways

• Revolut confirmed that an attacker used a legitimate government agency’s email domain to request customer data, and the request was fulfilled because it carried valid domain authentication credentials.
• Exposed data reportedly included full names, birth dates, occupations, contact details, passport and driving licence copies, verification selfies, IBAN numbers, withdrawal records, and full transaction history, including Bitcoin transactions.
• Revolut said a limited but undisclosed number of accounts were affected and that its systems and customer funds were untouched.
• Crypto investigator ZachXBT said the breach appeared limited in scale but targeted at high-net-worth users.
• Zero-knowledge proof identity systems, such as ZK KYC paired with tools like zkDatabase, are designed to let services confirm a single fact instead of receiving a full copy of a customer’s identity file.

Revolut KYC Data Breach Incident

The breach did not come from a hacked server or a stolen database. It came from a well-crafted request that looked exactly like something Revolut’s team was supposed to trust.

Impersonation via Spoofed Government Email

According to Revolut, an unauthorized party sent fraudulent information requests using a legitimate government agency’s email domain. The company told affected customers that “as the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request,” according to details reported by BleepingComputer. Revolut described the episode as a “sophisticated external impersonation scam.” Once the scheme was detected, the company said it blocked the sender’s address and alerted the government agency involved, along with law enforcement, data protection authorities, and financial regulators. A Revolut spokesperson said the firm’s systems and customer funds were unaffected.

Data Exposed in the Breach

The scope of what left Revolut’s systems is the part that worries security researchers most. A notification sent to affected customers listed birth dates, postal and email addresses, phone numbers, occupations, and copies of passports or driving licences. According to Revolut, the exposed data may also have included selfies taken for verification, account statements, and transaction histories. BleepingComputer reported that the information sent to the impersonators additionally included IBAN numbers, withdrawal records, and full transaction history, including Bitcoin transactions. ZachXBT, the crypto fraud investigator who first publicized the incident, added that the leak appeared to target high-net-worth users specifically. Separately, a Reddit post has claimed that a group targeting Revolut is leaking data purportedly belonging to VIP clients and demanding payment while threatening to release more private messages and internal files — a claim that has not been independently verified. Revolut has not disclosed an exact number of affected customers.

Risks in Centralized KYC Management

The core problem is not that Revolut got tricked once. It is that a single approved request against a full identity file can hand over everything in that file at once. Banks and fintechs keep passports, selfies, and financial records together because Know Your Customer rules require reliable identification, but bundling identity documents with account and transaction data in one place means a single wrong disclosure reveals far more than whatever the requester actually needed to check.

Encryption protects a file while it sits in storage or moves across a network, and access controls decide who is allowed to receive it. Neither of those safeguards limits what the file actually contains once a request clears those checks. Multiply that across partners, product teams, and third parties who each get a copy for their own verification purposes, and the number of places a full identity dossier can leak from grows quickly. This is the structural weakness the Revolut KYC breach put on public display: not a broken vault, but a trusted-looking door that opened onto everything at once.

Zero-Knowledge KYC Technology as a Solution

An alternative model already exists, and it works by answering a narrower question than “here is the full file.” Instead of handing over documents, a service asks only whether a specific fact is true, and gets a yes or no.

How the Two-Step Verification Works

ZK KYC splits identity checks into two separate steps. First, a trusted issuer, such as a bank or a KYC provider, verifies the customer’s documents once and issues a credential — a signed digital statement confirming facts like KYC status or investor eligibility. This follows the roles defined in the W3C Verifiable Credentials Data Model, where an issuer signs the credential, a holder keeps it, and a verifier checks it later.

Second, whenever another service needs to confirm something, the customer’s digital wallet generates a Zero-Knowledge Proof — a piece of cryptography that proves a statement is true without revealing the underlying data — and the service receives only a pass or fail answer. This is how zero-knowledge proof identity checks work: rather than seeing personal details, the verifier only confirms that a certain condition holds true. In July 2025, Google designated German Sparkasse banks as the first national credential issuer for its EU age checks, a setup designed specifically so a service can verify claims such as “is over 18” or “holds a valid ID” without ever accessing the underlying personal data.

This design also makes verified status reusable. If one confirmed credential can be checked by multiple products or institutions, a customer who already passed KYC at one bank does not need to resubmit identity documents every time they open an account elsewhere. An investor could prove accreditation for a tokenized fund, or a user could prove valid KYC before joining a verified-only pool, all without the receiving service ever seeing the original passport or selfie. Each verifier still chooses which issuers and credential formats it trusts, which is why adoption spreads gradually rather than all at once.

Limitations of ZK KYC and Remaining Risks

ZK KYC does not eliminate every risk in the chain, and it is worth being direct about that. The issuer still holds the original documents and must hand them over when the law requires it, which means a fraudulent request that successfully passes the issuer’s own checks — the exact scenario Revolut described — can still pull a full identity file out of that one remaining point of exposure. What ZK KYC changes is everything downstream of the issuer: fewer partners, product teams, and outside services ever receive a copy of the raw documents in the first place, because most of them only ever needed a proof, not a file.

zkDatabase and Industry Adoption

Making proofs useful at scale requires a way to check them against an issuer’s records without exposing that data either, and that is the gap tools like zkDatabase are built to close.

zkDatabase Functionality and Privacy Features

Many tokenized asset platforms currently track KYC status through allow-lists — registries of approved addresses maintained by an operator — which forces every verifier to simply trust that entries were added and removed correctly. Described as a verifiable database powered by Zero-Knowledge Proofs, zkDatabase produces a proof for each operation, letting anyone verify the database’s integrity without having to trust the operator directly. Valid credentials are committed as a Merkle root, a short fingerprint of the entire list that changes whenever the list itself changes. zkDatabase wraps the Merkle membership check inside a Zero-Knowledge Proof, so a verifier learns only that a given credential is on the current list, without seeing the list’s contents or the credential’s position within it. When a credential is revoked, the list produces a new fingerprint that no longer includes it, and the revoked credential simply stops passing future checks. This is the essence of zkDatabase verification: proving the state of a list is accurate without exposing what is inside it.

Google and German Sparkasse Banks Example

Google’s July 2025 decision to name German Sparkasse banks as its first national credential issuer for EU age verification is the clearest real-world example of this model in production. It shows a major platform choosing to build age and identity checks around single-fact proofs rather than document exchanges. In a separate development, Orochi Network’s collaboration with zkPass integrates zkDatabase as the backend for a user-facing proof tool: zkPass enables users to demonstrate attributes like KYC status without exposing the underlying data, though each proof only verifies a single check at a specific moment, while zkDatabase supplies a provable backend anchoring those claims in a tamper-proof data state. Deutsche Bank’s 2024 proof of concept with Privado ID found that proofs simplified single-fact checks, even as the institutions on the other side of the transaction still had to complete detailed and costly KYC processes of their own.

Collectively, these rollouts show that the industry isn’t waiting for another breach to trial this approach — it’s already testing it in live systems covering age verification, tokenized assets, and cross-border banking. Whether this leads to fewer incidents similar to Revolut’s will hinge on how widely institutions adopt proof-based verification instead of continuing to pass complete identity files among departments and partners.

FAQ

How would ZK KYC reduce the impact of a KYC data breach?

ZK KYC reduces the impact of a KYC data breach by limiting routine checks to proofs of single facts, such as valid KYC status or age, minimizing systems holding full identity data.

What does zkDatabase do in a ZK KYC setup?

zkDatabase holds the issuer’s list of valid credentials as a Merkle tree and generates Zero-Knowledge Proofs that a credential is on that list without revealing personal data.

Can one KYC check be reused across institutions?

A KYC check can be reused only where the verifier accepts it; customers create a new proof for each service, and each verifier decides which issuers and formats it trusts.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.