Important update on Revolut, and why this concerns anyone here whose data sits with a KYC'd service, exchange or fiat on-ramp:
(1) According to the group now extorting
#Revolut, and the Duel team in contact with them, the attackers took over Italian government and law enforcement mailboxes with an infostealer, sent Revolut Bank UAB in Lithuania a forged European Investigation Order in the name of the Italian authorities, and kept sending requests for five months.
(2) Revolut answered every one, as
#FATF Recommendations and EU AML laws require. Refusal carries fines up to €5 million or 10% of turnover. Nothing in the rules obliges the bank to check whether the state behind the request is who it claims to be. Now scale this abuse a thousand times, in the hands of authoritarian states and their proxies, who do not seek attention like these hackers and quietly collect data on citizens and entities of the
#EU and other Western countries.
(3) The attackers claim to hold 147 GB from the
#Italian side, including internal documents and officer chat logs, and say most of the Revolut data concerns customers in
#Switzerland,
#France and
#Hungary, with other countries affected. Passports and
#KYC selfies of named individuals are being published daily until Revolut pays.
Every bank, exchange, payment provider and
#CASP in every jurisdiction that follows FATF rules is exposed the same way, because the rules oblige them to answer state requests and nobody is required to check whether the state behind the request is legitimate. Self-hosted wallets close one door. The moment your data touches a regulated intermediary the same channel opens.
Human rights groups, victims and experts, with support of Open Dialogue Foundation, described this risk to the European Parliament three years ago with support of
@jack @Obi 🔅 and few other bitcoiners. We proposed specific remedies, supported by the majority of the European Parliament. The European Commission and the Council removed every safeguard the Parliament adopted from the AML Regulation. That decision is why this is happening now.
Three institutions have since named this transnational financial repression: (1) European Parliament resolution of 18 June 2026, under MEP Hannah Neumann leadership; (2) Council of Europe Resolution 2669 of 25 June 2026, rapporteur MP Efstathiou, with MP Wiechel pushing for an investigation and remedies; (3) OSCE PA in The Hague, July 2026, led by MP Mauro Del Barbe, with the most detailed focus on exactly these attacks.
We are collecting witness statements to push for implementation. If you are a legal or security expert and want to support our work, DM me.
You want fewer surveillance channels open on you? The political fight decides which safeguards go back into the law. Support the MPs and MEPs who pushed for remedies. Demand accountability from Commission and Council for the ones they rejected. Before the next leak names someone who does not have the means to move house.
