They may know your full name, your phone number, the bank you use, and the date of a transaction you barely remember. They may have a copy of the passport you uploaded years ago because opening an account required it.
Meanwhile, your hardware wallet can be working perfectly.
Your recovery phrase can remain offline. Your private keys can remain secret. The protections you spent years learning can still be doing exactly what they were designed to do.
That is what makes the latest Revolut incident so uncomfortable. It exposes a security problem that survives even when the cryptography holds.
You can take your Bitcoin off an exchange without taking your identity out of its records.
The Data Leak Behind the Reassurance
On September 12, 2026, Revolut confirmed that fraudulent requests sent through a legitimate government agency email domain had led it to disclose sensitive customer information to an unauthorized third party. The company said its systems and customer funds were unaffected.
That reassurance matters. It also leaves a question hanging over everyone whose information was disclosed : what can someone do with the data now ?
According to the Financial Times, Revolut contacted approximately 680 customers following its initial investigation. That is a reported figure, rather than proof that every affected person held Bitcoin or that every record contained the same information.
Customer notifications described information that could include identity documents, addresses, verification images, account statements, IBANs, withdrawal records, and transaction histories, including Bitcoin activity. The categories potentially exposed went well beyond the details someone might find on a public social profile.
A passport connects the account to a person. A home address locates that person. Financial records add context about their money. Where a record identifies an on-chain withdrawal, it may also provide a starting point for investigating activity on Bitcoin’s public ledger.
None of those things is a private key. Together, they can still be valuable to someone trying to get your money.
