Data leak: are your crypto assets at risk?
In short: to open an account on a crypto platform or a neobank, you handed over your ID document, your address and sometimes a selfie. When this data leaks, as it did at Revolut in September 2026, it is used first for highly convincing scams, and sometimes to locate crypto holders at home: France now records more than one crypto-related attack or kidnapping attempt per week. You cannot prevent a leak, but you can make it useless: never follow a link or a number you receive, protect your accounts, split what you hold, and above all do not let people know what you own.
Updated on October 15, 2026. This article does not constitute financial advice.
What happened at Revolut
In September 2026, Revolut sent customer data to a fraudster posing as a government agency. The requests came from an email address that genuinely belonged to the domain of a public body, which hackers had hijacked; the Belgian press mentions an Italian administration (Business AM, 2026). Revolut's systems were not hacked: this is social engineering, a manipulation that consists of deceiving a person rather than breaking into a computer (Arntz, 2026).
The data sent is among the most sensitive there is:
- name, date of birth, postal address, email and phone number;
- copies of passports and driving licences;
- identity verification selfies;
- account statements and transaction history.
According to the press, 680 customers are affected, including 55 in France; Revolut is reimbursing the replacement of their identity documents (Business AM, 2026). The bank says customers' money was not touched and that it informed the people concerned directly (Arntz, 2026). Revolut has more than 80 million customers worldwide, many of them in Belgium.
This is not an isolated case. In 2020, a leak at Ledger, the French hardware wallet manufacturer, exposed the names, postal addresses and phone numbers of some 272,000 customers (CoinDesk, 2020). More recently, a leak at Waltio, a French crypto tax reporting service, exposed the email addresses of tens of thousands of customers (Morin, 2026b).
Why it is more serious for a crypto holder
A bank you keep at home
A specialised gendarme sums it up this way: holding crypto is like having a bank at home, but with no physical security at all (Morin, 2026b). A fraudulent bank transfer can sometimes be blocked; a bitcoin transfer, on the other hand, is instant and irreversible. That is what makes crypto holders attractive to criminals.
Kidnappings on the rise, especially in France
In France, the prosecutor's office specialising in organised crime counted, as of mid-April 2026, 135 kidnappings or attempts linked to crypto since 2023, including 18 in 2024, 67 in 2025 and already 47 cases opened in 2026. Since January 2026, that amounts to roughly one incident every two to three days, often very violent (Morin, 2026a). The gendarmerie links this rise to several major data leaks that exposed the identity, holdings and address of many holders (Morin, 2026a).
The phenomenon goes beyond France: from 5 to 9 October 2026, the French gendarmerie trained investigators from 26 countries in Lille, together with Europol (Rencurel, 2026). Belgium is a neighbour, shares the language of many French victims, and its residents use the same platforms.
The real everyday danger: the tailor-made scam
With your name, your address, your bank and sometimes your transaction history, a fraudster can call you posing as the “security department” of your platform, quote accurate details, and push you to “secure” your funds by sending them to an address he controls. This is targeted phishing: the more precise it is, the more convincing it is.
Are you affected?
| Your situation | Risk level | What to do first |
|---|---|---|
| Revolut has written to tell you that you are affected | High | Follow its instructions in the app, request replacement of your documents, be extra careful with phone calls |
| You are a customer of a crypto platform or a neobank | Medium | The habits below; check on haveibeenpwned.com whether your email appears in a known leak (the site does not know all of them) |
| You talk about your crypto in public (social media, forums, people around you) | Higher than it seems | Become discreet: it is the most effective measure and it is free |
| You hold large amounts | High | Split your holdings, avoid any public exposure, consider a security adviser |
The right habits
1. Never follow a link or a number you receive
A message or call asking you to “secure your account”, cancel a transfer or replace your documents should be treated as suspicious, even if it knows your name and address. Do not click on any link, do not call back any number you received: go yourself through the official app or the website typed in by hand (Arntz, 2026). No serious platform will ever ask for your recovery phrase (the 12 or 24 words of your wallet): anyone who asks for it is a scammer.
In Belgium, you can forward a suspicious message to suspect@safeonweb.be, the address of the Centre for Cybersecurity Belgium.
2. Lock down your accounts
- A different password for each platform, kept in a password manager.
- Two-factor authentication everywhere, preferably through an app (or a security key) rather than by SMS: a fraudster can get your phone number assigned to him by your mobile operator.
- A withdrawal address whitelist when the platform allows it: funds can then only go to addresses registered in advance.
- Regularly check the connected devices, cards and saved beneficiaries on your accounts (Arntz, 2026).
3. Split what you hold
Keep on a platform only what you need to buy or sell. The rest can be stored in a hardware wallet (a small device that keeps your private keys offline), whose recovery phrase is written on paper or metal and stored out of sight: never photographed, never in the cloud, and never typed on a computer or phone. For large amounts, some users split their holdings across several wallets or require several signatures for a withdrawal.
4. Be discreet, online and around you
This is the simplest and most neglected advice:
- do not post your gains, screenshots of your wallets, or your wallet address linked to your name;
- avoid wearing bitcoin-branded clothing or items, presenting yourself as a “crypto investor” on LinkedIn or talking about it with strangers;
- buy a hardware wallet from the manufacturer or an official reseller, have it delivered to a pick-up point rather than your home, check that the packaging is intact and set it up yourself;
- within your family, agree on what is said, and to whom.
5. If you are threatened
Your safety comes before your crypto. In the event of a threat or an attack, do not resist and alert the police on 101 as soon as possible, then the platform concerned. A transfer made under duress is irreversible. Investigators know how to trace funds on the blockchain, and sometimes have them frozen when they pass through a cooperating platform: the French gendarmerie describes ransoms frozen in its investigations (Morin, 2026b). This is never guaranteed.
Going further: why platforms have all your data
A crypto platform licensed under the European MiCA regulation is also subject to anti-money laundering rules, which require it to identify its customers: this is KYC (Know Your Customer). A copy of your ID document, a selfie and your address are therefore stored, sometimes for years after your account is closed, so that the platform can respond to the authorities.
It is a protection against money laundering, but it is also a highly coveted data reservoir. The Revolut case shows that the weak point is not always technical: a fake letter from an “authority” was enough. You can ask a platform what data it keeps and for how long, using the right of access provided by the GDPR. Closing accounts you no longer use limits the risks, even if the platform must keep certain data for the period required by law.
Test yourself
Sources
Arntz, P. (2026, September 14). Revolut a transmis des pièces d'identité et des données financières de clients à un faux représentant de l'administration. Malwarebytes. https://www.malwarebytes.com/fr/blog/news/2026/09/revolut-gave-customer-ids-and-financial-data-to-a-government-impostor
Business AM. (2026, October 8). Revolut indemnise les clients qui doivent demander de nouveaux documents d'identité à la suite d'une fuite de données. https://fr.businessam.be/?p=286902
CoinDesk. (2020, December 21). Why Ledger kept all that customer data in the first place. https://coindesk-coindesk-prod.cdn.arcpublishing.com/business/2020/12/21/why-ledger-kept-all-that-customer-data-in-the-first-place/
Morin, C. (2026a, September 12). La stratégie de la gendarmerie face aux cryptorapts (partie 1/2). Gendinfo, Gendarmerie nationale. https://www.gendarmerie.interieur.gouv.fr/gendinfo/terrain/immersion/2026/la-strategie-de-la-gendarmerie-face-aux-cryptorapts-partie-1-2
Morin, C. (2026b, September 13). La stratégie de la gendarmerie face aux cryptorapts (partie 2/2). Gendinfo, Gendarmerie nationale. https://www.gendarmerie.interieur.gouv.fr/gendinfo/terrain/immersion/2026/la-strategie-de-la-gendarmerie-face-aux-cryptorapts-partie-2-2
Rencurel, R. (2026, October 13). Criminalité crypto : la France forme les autres pays (UNCyber). Cryptoast. https://cryptoast.fr/criminalite-crypto-rapts-france-enqueteurs-26-pays-uncyber/