On September 12, 2026, Revolut confirmed a data breach affecting hundreds of clients with significant cryptocurrency holdings.
It wasn’t a cyberattack on the digital bank’s internal systems. It was something more insidious: a group of hackers posed as a government authority, and Revolut believed them.
Here’s what happened, reconstructed from the verified sources available today.
How the Attack Happened
Available information indicates that the attackers, a group calling itself “iamnotavillain,” targeted Revolut accounts belonging to high-net-worth clients, many of them active in the cryptocurrency space.
Then they did something worse than a direct cyberattack.
For several months, they posed as Italian law enforcement officers, using a genuine government email account traced back to the Prefecture of Reggio Calabria.
Journalistic reconstructions have pointed to the Prefecture as the possible source of the account used, but its involvement and the compromise of the account are still under investigation.
Through these requests, which appeared legitimate because they came from a genuine institutional domain, the hackers obtained from Revolut the data of roughly 680-700 clients identified as “crypto whales,” meaning those holding large amounts of capital in their accounts: identity documents, KYC verification selfies, IBANs, and cryptocurrency transaction history.
Most of the clients affected are based in Switzerland and France, with others residing in more than 30 countries, including the United Kingdom, Germany, and Spain.
Revolut stated that client systems and funds were not compromised, and that is technically accurate: this wasn’t unauthorized access to internal databases, but data voluntarily handed over by the company itself, believing it was responding to a legitimate legal request.
The group subsequently threatened to release further data, claiming to hold up to 147 gigabytes of internal Italian law enforcement material, and demanded a ransom.
British and Italian authorities have opened investigations.
Not an Isolated Incident: The April Fine
This isn’t the first episode to put Revolut in the spotlight for the wrong reasons in 2026.
On April 2, Italy’s Competition and Market Authority (AGCM) fined the fintech a total of over 11 million euros.
The grounds for the sanction covered three distinct areas:
- unclear communications about investment services marketed as “commission-free” without specifying additional costs and limitations;
- account management practices the Authority deemed aggressive, with insufficient information on the conditions and procedures for blocking or suspending accounts;
- lack of clarity on the timeframes and requirements for switching from a Lithuanian IBAN to an Italian one.
The Antitrust Authority highlighted one particularly significant point: the inability to access one’s own funds, even for extended periods, obstructs the exercise of contractual rights and the ability to meet life needs, including urgent ones.
Two different episodes, but with a common thread: how sensitive data and access to client funds are handled.
If You Hold Cryptocurrency Wealth, Solid Physical Alternatives Exist
The fact that the attack hit many clients with significant cryptocurrency holdings is no coincidence: it’s precisely the crypto profile that attracts this kind of attention, both from hackers and from fintechs’ automated controls.
What many people don’t know is that physical banks, with full banking licenses, in high-profile jurisdictions like Switzerland and Panama, are structured to be crypto friendly. Not digital wallets run by a fintech, but real banking institutions, with the ability to hold internal wallets linked to the account, managed under the same due diligence and protection standards that bank applies to any other asset.
For a profile with significant crypto exposure, identifying the right institution isn’t straightforward: not every bank accepts this type of client, and among those that do, operating conditions vary widely.
Through GloboBanks’ introduction service, an advisor analyzes your specific profile and pinpoints exactly which jurisdictions and which institutions are genuinely suited to that type of wealth, sparing you wasted attempts at banks that would filter out the application from the start.
To find the best solution for your situation, contact the team here for your pre-analysis
Fintech Accounts: When They Work, and When They Don’t
Let’s be clear: Revolut and fintechs in general aren’t the wrong tool.
For everyday spending, for overseas payments without steep conversion fees, for the convenience of an app you can open in thirty seconds while traveling, they’re efficient tools and useful for millions of people.
The point is understanding what they’re built for, and what they’re not.
The Revolut case is a good illustration of a structural problem affecting all fintechs, not a single isolated mistake.
A fintech typically operates through digital processes, automated monitoring systems, and centralized compliance teams.
These tools allow it to analyze huge volumes of transactions in real time, but they can also trigger verification requests when a transaction doesn’t match the client’s registered profile.
For an entrepreneur, this can become relevant when the account is used for operations such as:
- large international wire transfers;
- payments to new suppliers or foreign counterparties;
- transfers linked to companies within the same group;
- incoming payments that don’t match the account’s historical behavior;
- movements originating from exchanges, brokers, or other crypto operators;
- sudden changes in transaction volume or frequency.
None of these operations are illegitimate in themselves.
But they can trigger automatic or manual verification, especially when the bank doesn’t already have sufficient information about the client’s activity, the source of funds, and the economic rationale behind the operation.
A high-level private bank, in Switzerland or other jurisdictions with banking standards built up over decades, works on the opposite logic.
Initial due diligence is longer and more thorough, with the goal of truly knowing the client before opening the account, not during or after.
The bank also assigns a relationship manager to clients, to respond to requests and any issues in a more human, personalized way.
Support at fintechs, much like account opening, is more automated.
At high-level banks, this becomes not just a process of selection and exclusivity, but also an advantage for both the bank and the client.
It creates a genuine banking relationship, more “human” and closer to the client’s real needs.
It means the very structure of the service, designed for a small number of closely followed clients rather than for millions managed at a systemic level, reduces the type of vulnerability that hit Revolut.
A fintech, which generally focuses more on growing its numbers and customer base and becoming a service “for everyone,” is built more around speed and scalability.
Why a Serious Business Needs a Physical Bank
There’s another aspect that concerns entrepreneurs directly: fintechs freeze accounts more often than people realize, and it’s usually over transactions that fall outside the norm.
A significant international wire transfer, a payment to a supplier in a country considered high-risk, an incoming payment that doesn’t match the account’s usual pattern: these are exactly the kind of operations an entrepreneur handles routinely to grow a business, and exactly the kind of operations that trigger a fintech’s automated controls, risking a frozen account for days or weeks while it’s reviewed.
The reason is the same one seen above: systems built to handle enormous volumes of retail customers, with automated controls and initial due diligence that’s far less thorough than at high-level physical banks.
A physical bank with a full banking license carries out much more thorough due diligence when opening the account and for every significant transaction afterward.
It looks slower, more tedious, more bureaucratic — and in part, it is.
But it’s precisely that depth of verification, carried out by people who follow the relationship over time, that makes the account far more stable once the structure is set up correctly.
You don’t get sudden surprises on legitimate operations, because the bank already understands who you are and how you work.
The Case for Banking Diversification
There’s one last point, perhaps the most practical of all: you don’t need to abandon Revolut or any fintech you’re happy with.
Nothing stops you from continuing to use it. The question is where you position it within your overall structure.
If you’re an entrepreneur, having just one account, fintech or bank, means depending entirely on that single institution to keep your business running.
If that account gets frozen, whether from a check, a review, or an episode like Revolut’s, your entire operations stop at the same moment.
The correct structure involves multiple accounts, each with a precise function.
Revolut, or a similar fintech, can be useful for minor day-to-day expenses.
But to run the business, to receive important payments, to deposit capital that needs protecting, it makes sense to have operating accounts at physical banks, chosen based on your company’s jurisdiction: an account at a US bank if you have an LLC in the United States, an account in Hong Kong if your company is based there, a European account if you operate mainly in Europe.
And alongside these, a private banking account in Switzerland or another top-tier jurisdiction for the portion of your wealth that needs to stay protected over the long term.
The key, especially for anyone starting from a setup based solely on fintechs, is to diversify along two axes at once: by account purpose, and by jurisdiction and type of bank.
This way, no single freeze, no single review, no single episode like Revolut’s can bring the whole business to a halt.
GloboBanks works with over 60 banking institutions across more than 15 jurisdictions, including Swiss private banks and top-tier international institutions, to build exactly this kind of structure.
Access happens through a formal introduction, with deposits significantly lower than the public thresholds and direct relationships with dedicated relationship managers.
If you want to understand which structure fits your profile, the team offers a confidential initial review.
Contact the team for your pre-analysis
