Revolut Denies Direct Contact After $3M Public Ransom Demand

Revolut says it has received no direct messages from the hackers publicly demanding a ransom over a customer data breach, even as multiple groups compete for credit and threaten further disclosures.

A faction using the name “IAmNotAVillain” demanded 6,000 Monero (XMR)—worth about $3 million—within 24 hours, according to a report by the Financial Times. On Thursday, a Revolut spokesperson told Cointelegraph that the company has not received any direct contact or demand from the individuals behind those claims.

Key takeaways

• Revolut confirms it has not received direct communication from “IAmNotAVillain” despite public ransom threats.
• A rival claimant (“Revolut Smilik”) previously circulated a far larger Bitcoin demand, widening uncertainty over who controls the stolen data.
• Investigators in Italy are broadening the probe because the suspected intrusion involves an alleged compromise or cloning of a government email account.
• Regulators are pressing banks to review access security, suggesting the issue may extend beyond a single breach channel.

Competing ransom claims muddy attribution

Revolut’s lack of direct contact matters because public ultimatums do not automatically indicate which party actually holds the data, how much has been extracted, or whether the threat is actionable. In this case, “IAmNotAVillain” is only one name attached to online claims related to the breach.

Cointelegraph previously reported that Revolut disclosed the incident last week and tied its exposure to alleged access obtained using a fake government email account. When Cointelegraph attempted to check the “IAmNotAVillain” website, iamnotavillain.xyz, it was unavailable at the time of publication.

Adding further ambiguity, an earlier group calling itself “Revolut Smilik” reportedly made a demand of 10,000 Bitcoin (about $780 million at the time), a figure dramatically larger than the later XMR demand reported by the Financial Times.

In a notice on its site, “IAmNotAVillain” disputed the competing claim, alleging that a former associate had received only a small sample of the data before taking credit for the breach. The site also warned other parties not to “deal” with the rival claimant—an escalation that typically reflects internal disputes among actors rather than proof of control over the full dataset.

Meanwhile, a cybersecurity-focused account, Dark Web Informer, also flagged another website—revoloot.lol—as associated with a separate actor claiming responsibility. That site was also unavailable when checked by Cointelegraph. Together, these competing claims make it difficult for outside observers to confidently map which group is operating the extortion pipeline.

Why Revolut’s response is significant for customers and markets

Extortion incidents increasingly unfold as a chain of claims, samples, and retractions across multiple domains—often making it hard to determine whether a victim’s infrastructure can be directly negotiated with. Revolut’s statement that it has not received any direct contact suggests the company cannot yet validate that the public demand corresponds to a party willing or able to engage with the organization privately.

For affected customers, this distinction matters because it affects expectations around mitigation. Direct communications can sometimes include specifics about the data or the steps required to verify deletion. Without that channel, customer-impact assessments and remediation efforts rely more heavily on forensic findings than on attacker instructions.

For the broader crypto audience, the ransom component underscores how extortion ecosystems increasingly mix anonymity-preserving assets such as Monero with shifting claimant identities. In practice, the exact asset and headline valuation can change faster than the underlying breach details—particularly when multiple groups are signaling from the sidelines.

Italy expands the investigation beyond a single victim

While the extortion messaging continues online, the law-enforcement angle is also deepening. According to Italian news agency ANSA reported on Wednesday, Italy’s National Anti-Mafia and Anti-Terrorism Directorate has become involved because the suspected intrusion appears to concern a government entity.

Prosecutors in Reggio Calabria have opened an investigation into unauthorized access to a computer system of public interest. Investigators are working to determine whether the institutional email account was breached outright or cloned—an important technical distinction that can affect both accountability and how the wider ecosystem was targeted.

Italy’s privacy regulator has also asked banks to urgently review the security of their access systems. The regulator is separately examining whether other banks or financial institutions may have been affected, implying that the breach method may not have been isolated to Revolut’s environment.

Earlier coverage from Cointelegraph noted that the investigation centers on a government email account allegedly used to obtain customer data. With multiple claimant narratives still unfolding online, the official inquiry remains a key reference point for what investigators can substantiate about the intrusion path.

What to watch next

Investors, security teams, and customers should watch for two developments: whether Italian investigators can confirm the mechanism behind the government email compromise or cloning, and whether any attacker claim evolves into verifiable direct contact with Revolut or corroborating evidence about the amount and scope of the exposed data.