Two security stories dominated the past 36 hours, and together they make a strong case for understanding exactly who holds your data — and who holds your Bitcoin.
Revolut Tricked Into Handing Over User Data
Revolut, the digital bank with tens of millions of customers worldwide, fulfilled a fraudulent information request that appeared to come from a legitimate government agency's email domain. According to reporting from CoinDesk and Decrypt, the exposed records included passport scans, selfie photos, home addresses, and — most relevant to Bitcoin users — complete crypto transaction histories. No customer funds were taken, but the data breach is significant on its own terms.
Onchain investigator ZachXBT speculated the attack was specifically targeting high-net-worth users, suggesting the fraudsters knew what they were looking for. The incident reveals a specific vulnerability: sophisticated attackers can spoof or compromise government email domains well enough to fool a major fintech company's compliance team. Revolut described the number of affected users as "limited" but has not published a precise figure.
The practical takeaway is that transaction history exposure can be as damaging as fund theft. Knowing what someone holds, when they moved it, and roughly where they live creates a roadmap for follow-on attacks — whether digital or physical.
Blockstream Facing a $47 Million Standoff
In a separate and equally serious incident, Decrypt and Bitcoin Magazine both reported that white-hat hackers exploited a vulnerability in Blockstream's Liquid sidechain and removed more than 4,000 Bitcoin. The hackers say they want to keep a portion as a finder's fee. Blockstream is calling it theft, full stop.
With roughly 598.5 BTC still outstanding — worth close to $46 million at current prices — Blockstream has publicly told the hackers to return the funds or face law enforcement referral. The company is not negotiating a bounty. This puts the situation in a gray area that security researchers sometimes call a "forced bug bounty": the hackers did find a real vulnerability, but taking funds without prior authorization crosses a clear legal line regardless of intent.
Liquid is a federated sidechain built on top of Bitcoin, used primarily for fast settlement between exchanges. The funds themselves are backed by Bitcoin locked in a multisig federation. This breach does not affect Bitcoin's base layer, but it raises fresh questions about the security assumptions of layer-2 and sidechain infrastructure.
What These Two Stories Share
Both incidents point at the same underlying risk: custody and data are inseparable concerns. Knowing who holds what is often the first step toward taking it. Revolut's breach exposed transaction data without touching wallets. Blockstream's situation involved actual Bitcoin moving without authorization. Neither category of risk is hypothetical anymore.
- For individual users: Be cautious about keeping detailed transaction history with any custodial or semi-custodial service if you hold significant amounts.
- For institutions: Verify information requests through out-of-band channels — a matching email domain is not sufficient proof of authenticity.
- For developers: Sidechain and layer-2 bridges carry concentrated risk that base-layer Bitcoin does not.
Bitcoin's price sits near $76,710 as of this morning, little changed from Friday. The market has largely moved past the week's inflation data without dramatic reaction.
For donors sending Bitcoin to charitable causes, these stories are a useful reminder that on-chain, self-custodied transactions — where you control the keys — keep your giving history out of any third party's hands.