Hackers behind the Revolut customer data breach have demanded 6,000 Monero, worth about $3 million, while threatening to sell the stolen records unless the bank pays within 24 hours.

How Revolut hackers set the 24-hour deadline

The Financial Times reported that a group calling itself “iamnotavillain” published the ransom demand on Wednesday alongside a countdown clock. The hackers said Revolut had 24 hours to send 6,000 XMR before they offered the customer records to other criminal groups.

At an implied value of about $500 per token, the demand totals approximately $3 million. The group selected Monero because the cryptocurrency is designed to conceal information about the sender, recipient and amount involved in a transaction.

According to the FT, no negotiations between Revolut and the hackers had taken place by the time its report was published. Revolut had not said whether it planned to respond to the demand or confirmed that the group controlled the stolen information.

The hackers provided the newspaper with a 60-second screen recording that appeared to display part of the material in their possession. Passports, driving licences, photographs submitted during know-your-customer checks and customer transaction histories appeared in the video, according to the report.

At least 680 accounts were affected, although Revolut has publicly described the number only as a “very limited” portion of its customer base. A previous crypto.news report found that Britain’s Information Commissioner’s Office had opened an investigation after the company reported the incident to regulators.

Revolut has said its own systems and customer funds were not compromised. Instead, the disclosure occurred after the company received fraudulent requests through an email account using the domain of a legitimate government agency.

Fake government requests exposed Revolut customer records

Rather than breaking directly into Revolut’s infrastructure, the attackers posed as government officials seeking customer information. The requests carried valid domain-authentication credentials and passed the checks Revolut used to assess their legitimacy.

Revolut then supplied customer records before discovering that the requests were fraudulent. Once the scheme was identified, the company said it blocked the email address and contacted the government agency, law enforcement, data-protection authorities and financial regulators.

As initial coverage detailed, the information released included full names, dates of birth, occupations, home addresses, email addresses and telephone numbers. Copies of passports or driving licences and selfies provided for identity verification were also among the listed records.

Account data included International Bank Account Numbers, account-opening dates, account status, withdrawal records and complete transaction histories. Bitcoin wallet reference numbers and records of Bitcoin transactions were also contained in some account statements.

Revolut’s customer notice distinguished identity-check photographs from biometric facial telemetry data, which the company said was not part of the disclosure. The notice also did not identify private keys, passwords, security codes or complete payment-card details among the exposed information.

An earlier company statement described the incident as a “sophisticated external impersonation scam” and maintained that Revolut’s systems remained secure. The company has not publicly identified the government agency whose email domain was used or explained how the attackers gained access to an account operating through that domain.

Blockchain analysis reportedly identified crypto-rich targets

The hackers told the FT that they used blockchain analysis to select Revolut customers who appeared to hold substantial amounts of cryptocurrency. Their account, if accurate, would indicate that the affected group was chosen partly through its financial activity rather than through a random collection of customer profiles.

On-chain investigator ZachXBT had previously said the incident appeared to involve high-net-worth users, though Revolut had not confirmed that assessment. The hackers’ latest statement provides a similar account of their targeting method, but it has not been independently verified.

Public blockchains can expose transaction histories, wallet balances and transfers between addresses. Analysts can sometimes connect that activity with an identified person when an exchange, financial company or other service holds records linking a customer account to a blockchain address.

The disclosed Revolut records may contain both sides of that connection. Identity documents and contact information can identify the account holder, while Bitcoin transaction histories and wallet reference numbers can map parts of the person’s crypto activity.

An August review of privacy coins explained that Monero makes transaction privacy mandatory. Its ring signatures obscure the true sender among a group of possible participants, stealth addresses hide the recipient’s public address, and Ring Confidential Transactions conceal the amount sent.

Criminal use of XMR does not establish that the token or all of its users are engaged in illegal activity. Monero also serves people seeking financial privacy, but its design can make illicit payment trails more difficult for investigators to follow than activity conducted on transparent networks such as Bitcoin or Ethereum.

A separate August case showed the same challenge after investigators said assets from a reported $7.9 million Coinsbuy hack were converted into Monero. Blockchain firms tracked portions of those funds through several exchanges before some assets were reportedly exchanged for XMR.

What the breach means for U.S. crypto customers

The FT report did not specify whether any of the 680 affected accounts belonged to U.S. customers. Still, the combination of verified identity records and crypto transaction data creates a relevant risk for Americans who receive messages claiming to come from Revolut, an exchange, a government agency, or a wallet provider.

Such records could allow criminals to craft messages containing a real name, transaction, account detail, or identity document. The presence of accurate personal information does not prove that a caller or sender represents the bank.

Revolut’s U.S. security guidance says the company will not unexpectedly call customers and ask them to make a payment or disclose verification and security codes. Customers who receive suspicious contact can verify it through the company’s in-app support channel.

For Americans whose personal or banking information has been exposed, the Federal Trade Commission directs consumers to IdentityTheft.gov for steps based on the type of data involved. The agency also advises users to report phishing attempts through ReportFraud.ftc.gov.

The FBI’s Internet Crime Complaint Center asks people reporting cryptocurrency-related fraud to provide wallet addresses, transaction amounts, asset types, transaction hashes, and the dates and times of transfers when available.

Robinhood takes market integrity seriously and has zero tolerance for insider trading,” a Robinhood spokesperson said in an email statement. “We immediately investigated and reported this matter to law enforcement and regulators, and will continue to cooperate with their investigations.”

The filing against Chai and the one against Xiang claim the two were designated “Coin Aware Individuals,” a group with access to a private Slack channel containing information about planned listings. Robinhood’s policy barred those employees from trading the tokens on any platform before, and for 24 hours after, a public listing announcement.

Perpetuals are derivative products that allow investors to take positions on the price movements of an underlying digital asset without owning the asset itself. Unlike traditional futures contracts, perpetuals do not expire and can be maintained indefinitely, and traders make or receive periodic funding payments to keep their positions open.

The Chai complaint alleges he traded ahead of at least 10 Robinhood listing announcements. The Xiang complaint alleges he did so on at least 11 occasions.

“Hefu Chai and Huaisong Xiang are charged with commodities fraud and wire fraud for allegedly exploiting confidential business information taken from their employer to trade perpetual futures,” said James C. Barnacle Jr., FBI assistant director in charge.

The House Ways and Means Committee approved a new crypto tax bill on Tuesday. Lawmakers passed the measure by a 38-5 vote. The crypto tax bill arrives one day after a separate market-structure bill stalled in the Senate.

Committee Approves Crypto Tax Bill

Republican and Democrat lawmakers backed the crypto tax bill after more than a year of negotiations. The legislation creates the first federal tax framework built specifically for digital assets. Committee leaders called the vote a milestone for the panel.

The crypto tax bill carries the formal designation H.R. 10357. It rewrites parts of the Internal Revenue Code covering digital assets. The bill adds a de minimis exemption for small network and transaction fees.

Payments under $10 would avoid gain or loss recognition under the rule. The crypto tax bill also simplifies accounting for widely traded digital assets. It sets special tax treatment for qualifying dollar-pegged stablecoin transactions.

Crypto Tax Bill Keeps Core Rules Intact

The crypto tax bill preserves several existing tax principles for digital assets. Wash sale and constructive sale provisions remain part of the framework. Mining and staking income keep their current tax treatment.

New broker reporting requirements for digital-asset transactions appear in the text. The bill also creates a voluntary disclosure program for taxpayers. Eligible filers could use the program to fix past compliance issues.

Committee members from both parties framed the crypto tax bill as balanced. It combines new relief with continued oversight of digital-asset markets. The panel’s approval sends the bill toward further House action.

Senate Setback Frames the Debate

The Senate failed to advance the CLARITY Act on Monday. The market-structure bill received 49 votes, short of the 60 needed for cloture. The procedural vote blocked debate rather than deciding the bill’s fate.

Senator Thom Tillis switched his vote from yes to no during the count. He changed course only after the bill’s defeat became clear. A senator from the prevailing side can request reconsideration of cloture.

The House committee’s action contrasts with the Senate’s gridlock this week. The crypto tax bill now moves forward while the CLARITY Act waits. Attention now shifts to whether the Senate revisits its vote on market structure.

Ethiopia has reportedly cut the electricity it delivers to Bitcoin mining operations amid worsening drought conditions tied to El Niño, according to Bloomberg. The reduction reportedly brought miner power down to 23% of contracted levels as lower water inflows strained the country’s hydroelectric system.

In a Tuesday report, Bloomberg said El Niño intensified dry weather across eastern Africa, reducing reservoir inflows by 20%. Ethiopian Electric Power (EEP) chief executive Ashebir Balcha told the outlet that the utility prioritized households and industrial customers as hydropower availability fell.

Key takeaways

• Ethiopia reportedly reduced Bitcoin mining power deliveries to 23% of contracted levels due to a 20% drop in reservoir inflows, according to Bloomberg.
• EEP says it cut miner supply in stages—initially to 75% of contracted levels—before easing further to 50% and then 23%.
• With miners reportedly taking 35% of EEP revenue last fiscal year and using close to one-third of national electricity output, the decision highlights how mining supply depends on hydrology.
• EEP plans a reassessment in October, with potential for deeper reductions or electricity export restrictions.

Hydropower shortage forces EEP to prioritize demand

EEP’s decision underscores the vulnerability of mining operations that rely on affordable, flexible electricity sourced from hydropower. Bloomberg reported that EEP began by cutting deliveries to 75% of contracted levels, then lowered deliveries to 50%, before ultimately reaching 23% as reservoir inflows continued to weaken.

The executive’s rationale was straightforward: in periods of constrained hydropower generation, utilities typically must allocate electricity to essential consumption first. Balcha indicated that EEP would reassess conditions in October, and that the company could respond with additional reductions or even restrict electricity exports to neighboring countries if supply tightness persists.

For miners with long-term power arrangements, staged curtailments can materially affect operating costs and uptime. They may also raise questions about how renewable-leaning power contracts are structured during extreme weather—especially when the same electricity must serve both residential and industrial users.

Why Ethiopia’s mining share makes curtailments consequential

Bitcoin mining’s footprint in Ethiopia is unusually large relative to many jurisdictions, which is why a hydro-driven cut can ripple through both energy economics and broader mining capacity decisions.

Bloomberg reported that miners accounted for 35% of EEP’s revenue in the last fiscal year and consume almost one-third of Ethiopia’s electricity output. That concentration means a contraction in deliveries affects EEP’s income stream, while also demonstrating how miners’ ability to operate can be limited by national supply constraints.

The country’s low-cost hydropower has also helped attract overseas mining capacity. Bloomberg noted international interest, including Phoenix Group, which expanded its Ethiopian mining capacity to 132 megawatts in April 2025, following earlier additions covered by Cointelegraph. Earlier buildouts suggest investors have been willing to underwrite costs based on access to relatively inexpensive electricity—an assumption now directly challenged by drought conditions.

More restrictive mining economics after Bitcoin halvings

Beyond Ethiopia’s immediate supply pressures, a separate discussion among Bitcoin analysts is pointing to broader headwinds for mining demand for electricity and capital. Economist Saifedean Ammous, author of The Bitcoin Standard, argued in a Tuesday post on X that global Bitcoin mining electricity consumption and capital expenditure may have peaked in 2024 to 2025.

Ammous’s reasoning centers on Bitcoin’s halving mechanism, which cuts the block reward miners receive by half roughly every four years. He suggested that if mining rewards keep shrinking in dollar terms, mining operations could slow or contract unless there is a significant counterweight—such as a sustained rise in Bitcoin’s price.

In the same post, Ammous said Bitcoin would need to increase more than 18.92% per year to keep the dollar value of newly mined coins growing, even before accounting for dollar depreciation. The argument effectively ties mining profitability to two variables: the mechanical reduction in issuance and the market price offsetting that reduction.

He also referenced price weakness, noting that Yahoo Finance data shows Bitcoin is down more than 35% over the past 12 months. In that context, Ammous said it would be expected for mining activity to slow, contract, or at least not expand—unless mining metrics improve.

AI computing competition may further complicate mining’s power equation

Ammous also raised a competitive angle: artificial intelligence data centers may provide an alternative use for power and infrastructure that miners otherwise monetize. The logic is that when mining returns weaken, electricity access and specialized connectivity can become more attractive for other high-demand compute consumers.

To support that perspective, he cited VanEck data, and Miner Weekly’s June estimate that public miners could require around $50 billion to build planned AI infrastructure. The implication is not that miners abandon Bitcoin entirely overnight, but that weaker mining economics may encourage some companies to redirect capital toward AI-related opportunities.

Ammous framed his conclusions as a testable hypothesis. He acknowledged that significantly higher transaction fees—or a sustained recovery above Bitcoin’s previous electricity-consumption peak—could invalidate the view that mining power demand has topped out.

For now, Ethiopia’s curtailment adds a concrete, near-term reminder that mining depends not only on market prices and halving cycles, but also on local energy availability and national policy tradeoffs. Readers should watch EEP’s October reassessment for potential additional constraints, alongside broader industry signals on whether global mining electricity use stabilizes or declines as reward economics continue to tighten.

Celsius Network’s bankruptcy estate has sued BitMEX for the return of 6,360.17 Bitcoin, worth about $495 million, over forced liquidations carried out during the March 2020 COVID market crash.

The complaint, filed on Sep. 12 in the U.S. Bankruptcy Court for the Southern District of New York, accuses BitMEX-linked companies of fraud, breach of contract, and unjust enrichment tied to the exchange’s liquidation system.

Blockchain Recovery Investment Consortium filed the case in its role as litigation administrator under Celsius’ bankruptcy plan. The defendants are HDR Global Trading, ABS Global Trading, Shine Effort, 100x Holdings and HDR Global Services.

Operating through several jurisdictions, the named entities have links to Bermuda, the Cayman Islands, England, Hong Kong, the Seychelles and the United States. The filing places the dispute before a U.S. bankruptcy court because the contested claims form part of the remaining assets being pursued for Celsius creditors.

Celsius estate seeks 6,360 BTC from BitMEX

According to the complaint, Celsius lost 1,325.84 BTC when BitMEX liquidated its position on March 12, 2020. Investment fund JST lost another 5,034.33 BTC through a liquidation the following day and later assigned its claims to the Celsius estate.

The two positions were structured to earn a return if Bitcoin either held its value or rose, the estate said. Bitcoin instead fell sharply as global markets reacted to the spread of Covid-19, with the sell-off producing one of the most volatile periods in the cryptocurrency’s history.

During the disorder, leveraged positions on derivatives exchanges faced margin calls and forced closures. Celsius and JST allege that BitMEX did more than close their positions to cover trading losses, claiming the exchange took control of Bitcoin collateral that should have been returned.

At the roughly $77,800 valuation used in the supplied claim, the combined 6,360.17 BTC is worth close to $495 million. The value of any potential recovery would still depend on the court’s findings and the form of relief granted, as the lawsuit remains at the complaint stage.

The litigation administrator is pursuing the Bitcoin itself rather than limiting the demand to its dollar value in March 2020. Its claims include fraudulent transfer, conversion, breach of contract, breach of the implied duty of good faith and fair dealing, and unjust enrichment.

BitMEX allegedly controlled both sides of liquidations

At the center of the case is BitMEX’s control over the mechanism that determined when leveraged positions would be closed. The Celsius estate alleges that the exchange also controlled the insurance fund that received assets generated by some liquidations, creating a financial interest in how the process operated.

“BitMEX intentionally designed its platform and liquidation procedures to cause liquidations of collateral and defraud its own customers,” the complaint says.

Rather than sell only enough collateral to settle an account’s obligations, BitMEX allegedly retained excess Bitcoin after closing positions. The defendants have not been found liable for the conduct described in the filing, and the allegations will need to be tested through the U.S. court process.

Similar claims appeared in a proposed class action filed in July by BKX Services and trader David Namdar. As crypto.news previously reported, the plaintiffs alleged that BitMEX engineered forced liquidations and retained 622.66 BTC that should have gone back to customers.

BKX said it lost at least 305.81 BTC, while Namdar claimed losses of more than 316.85 BTC. Their case also alleged that BitMEX’s internal trading operation had access to private customer information and could continue operating during server outages that stopped users from managing their positions.

The proposed class action seeks to represent eligible U.S. traders who used BitMEX’s Bitcoin perpetual swap products in transactions dating back to July 23, 2018. Celsius’ complaint is separate and concerns losses from March 2020, although both cases challenge how the exchange handled customer collateral during forced liquidations.

The case adds another asset-recovery effort for creditors

Celsius’ pursuit of BitMEX forms part of the litigation left behind by the crypto lender’s Chapter 11 case. Celsius froze withdrawals in June 2022 and filed for bankruptcy the following month after losses and liquidity problems left customers unable to retrieve their assets.

Court records later raised questions about the gap between the lender’s public claims and its trading practices. Celsius had promoted strategies such as arbitrage, carry trades and funding-rate harvesting as relatively low-risk ways to generate returns for depositors.

A July 2022 bankruptcy filing said the company had instead used “several highly speculative derivative and asset deployment mechanisms.” Court-appointed examiner Shoba Pillay’s final report also documented trading, risk-control and recordkeeping failures inside the lender.

The BitMEX position described in the new complaint relied on pooled customer assets and carried leveraged exposure during a severe market decline. Although the liquidation allegedly harmed Celsius, the bankruptcy records show that the lender itself had exposed customer funds to speculative trades while presenting its business as safer than its internal practices suggested.

Celsius began working through its repayment plan after a New York bankruptcy judge approved its restructuring. In January 2024, the company started distributing assets under a plan that provided more than $3 billion in cryptocurrency and other property to creditors.

Creditor recoveries later included shares in Ionic Digital, a Bitcoin mining company created through the restructuring. Former Celsius creditors received about 37 million Class A shares, and Ionic subsequently secured SEC approval for its planned Nasdaq listing in July.

A third payout round began in August 2025 with approximately $220.6 million allocated to eligible creditors. Recoveries obtained through estate litigation can add assets to the bankruptcy process, although the BitMEX complaint does not guarantee a payment or set a timetable for resolving the claims.

BitMEX faces the lawsuit before its Sep. 23 closure

The Celsius action is the second lawsuit challenging BitMEX’s liquidation practices since the exchange announced in July that it would close. BitMEX instructed customers to wind down positions and withdraw funds before trading ends on Sep. 23.

Founded in 2014, the exchange became known for offering highly leveraged cryptocurrency derivatives, including its Bitcoin perpetual swap. Its influence later declined as competition increased and regulated futures platforms gained more institutional business.

BitMEX has also faced prior action from U.S. authorities. In January 2025, a federal judge ordered HDR Global Trading to pay a $100 million criminal fine after the company admitted violating the Bank Secrecy Act by operating without an adequate anti-money-laundering program.

The criminal case concerned BitMEX’s compliance controls between 2015 and 2020, not the liquidation conduct alleged by Celsius. U.S. prosecutors said the exchange had served American customers without the required safeguards, while earlier civil proceedings brought by the Commodity Futures Trading Commission and Financial Crimes Enforcement Network produced settlements of up to $100 million.

BitMEX co-founders Arthur Hayes, Benjamin Delo, and Samuel Reed had pleaded guilty in 2022 to Bank Secrecy Act violations. President Donald Trump pardoned the three founders in 2025, along with former executive Gregory Dwyer and the corporate entities connected to the exchange.

Bitcoin price traded near $76,200 after a volatile week as the failed CLARITY Act vote and the Federal Reserve’s rate increase kept pressure on the market. Technical indicators now point to resistance near $78,600, while liquidation data places the main downside liquidity cluster around $74,600.

Bitcoin price retreats after rejection near $80,000

According to data from crypto.news, Bitcoin (BTC) was trading near $76,236 at the time of writing, according to the daily chart. The cryptocurrency had recovered from an intraday low of $75,065 after opening the session around $75,644.

BTC has lost roughly 4% over the past seven days after failing to hold an advance toward $80,000. Price briefly reached approximately $79,800 on Sep. 11 before sellers regained control, sending it as low as $74,944 on Sep. 15.

The weekly decline followed the U.S. Senate’s failure to advance the Digital Asset Market CLARITY Act. The procedural measure received 50 votes in favor and 49 against but needed 60 votes to move forward.

The proposed legislation sought to define how the Securities and Exchange Commission and Commodity Futures Trading Commission would divide oversight of digital assets. Its failure reduced the prospect of Congress establishing a federal crypto market structure before the November midterm elections.

Macroeconomic conditions added to the pressure. The Federal Reserve raised its target rate by 25 basis points to a range of 3.75% to 4.00% on Sep. 16, delivering its first increase since 2023.

Bitcoin briefly reacted to the widely expected decision but remained close to its four-week low. Higher rates can reduce demand for non-yielding and risk-sensitive assets by raising returns available from government debt and strengthening the U.S. dollar.

Daily Bitcoin indicators show weakening demand

The daily chart shows BTC trading below its 20-day simple moving average at $78,104. Reclaiming that level would be an early sign that buyers are regaining short-term control.

Bitcoin remains above the other major averages shown on the chart. The 50-day SMA stands near $71,933, while the 200-day and 100-day averages sit around $70,320 and $67,639, respectively.

The distance between the current price and those longer-term averages means the wider recovery from Bitcoin’s summer lows has not yet broken down. However, failure to recover the 20-day average could expose the lower moving-average cluster between $70,300 and $71,900.

Chaikin Money Flow has fallen to -0.11 after spending much of late August and early September above zero. A negative CMF reading indicates that selling pressure has exceeded buying pressure over the indicator’s 20-period window.

The change is notable because the CMF weakened as Bitcoin retreated from the $80,000 area. A return above zero would signal improving capital flows, while a deeper negative reading would add weight to the bearish setup.

Bitcoin faces 4-hour resistance at $78,600

Bitcoin’s 4-hour chart keeps the short-term trend bearish. The Supertrend indicator has flipped above the price and now marks resistance near $78,597.

BTC also trades below the indicator’s previous support line around $76,648. Bulls would need to reclaim that level before challenging the heavier resistance zone between $78,100 and $78,600.

The 4-hour Relative Strength Index stands at 43.01, slightly above its signal average of 42.54 but below the neutral 50 mark. The reading shows weak momentum without placing Bitcoin in oversold territory, leaving room for another decline if support fails.

Initial support sits between $75,000 and $75,500, covering the Sep. 15 low and the recent 4-hour range floor. A confirmed break below that area could send BTC toward the daily moving-average region near $71,900.

Crypto trader Daan Crypto Trades said Bitcoin was positioned near its August lows and the 4-hour 200-period moving averages after two major events dominated the previous week.

“Getting them out of the way, regardless of outcome, should make price action a bit less choppy,” the trader said.

A move through $78,600 would invalidate the immediate bearish Supertrend signal and place $80,000 back in focus. Failure to clear the indicator would preserve the pattern of lower highs visible since early September.

Liquidation heatmap puts $74,600 in focus

CoinGlass’s three-day liquidation heatmap shows the largest nearby pool of leveraged positions around $74,600 to $74,700. The concentration sits below the recent low and could attract price if sellers push BTC beneath $75,000.

Liquidity is also concentrated above the market. The closest large bands appear between approximately $76,600 and $76,900, followed by a stronger zone around $77,500 to $77,800.

Further clusters are visible near $78,300 and $80,000. A rebound through the closest overhead bands could force short liquidations and accelerate a move toward the 4-hour Supertrend resistance.

The heatmap does not predict direction, but it identifies areas where forced position closures could increase volatility. With liquidity sitting on both sides of the current price, BTC could continue to produce sharp moves until it closes outside the $74,600–$78,600 range.

Ali Martinez identified $71,200 as another downside area, based on Bitcoin’s short-term holder realized price. The metric represents the average acquisition price of coins held by newer investors and can act as an important level during market corrections.

BlackRock, DTCC, Intercontinental Exchange, Mastercard, Standard Chartered and Visa are among Arc’s founding validators, while BNY, HSBC and State Street are some of the 100+ institutions and ecosystem companies live on or exploring the network.

Trading venues on Arc include Uniswap and Aerodrome, while Aave and Morpho are providing lending markets. Tokenized money market funds including Circle’s USYC and BlackRock’s BUIDL are also coming to the network.

Allaire called Arc a “canonical home for asset issuers,” where funds, equities, commodities and currencies could be issued before moving to other blockchain ecosystems through Circle’s interoperability infrastructure.

Circle Payments Network is also being integrated directly into Arc alongside StableFX, its foreign-exchange platform for 24/7 cross-currency settlement.

Arc was designed around some of the friction that has kept traditional financial institutions from using existing blockchains, Allaire said.

Circle is developing configurable privacy for institutions that need to shield transaction data while retaining access for auditors and regulators.

Transaction fees are paid in USDC rather than a volatile native token, with sub-second finality and a permissioned validator set.

Balancing act

Allaire compared requiring companies to hold a blockchain’s native token just to use the network with making Netflix buy Amazon shares to pay its Amazon Web Service bill.