Key takeaways

• XRP’s long-to-short ratio stands at a bullish 1.06 as funding rates turn negative. 
• XRP holds above its 50-day and 100-day EMAs at $1.284 and $1.255.
• A daily close above the 200-day EMA at $1.353 could place $1.90 in focus.

XRP extended its recoveries on Thursday after finding support at important technical levels. However, conflicting funding rates, long-to-short positioning, and on-chain signals indicate that traders remain uncertain about whether the rebounds can continue.

XRP traded near $1.30 while holding above its 50-day and 100-day exponential moving averages. A close above the 200-day EMA at $1.353 is required to strengthen its recovery.

XRP traders show mixed positioning

XRP’s long-to-short ratio rose to 1.06 on Thursday, approaching its highest level in more than a month, according to CoinGlass.

A ratio above one means traders hold more long positions than shorts, signaling a moderately bullish positioning bias.

Funding rates complicate the derivatives outlook for both tokens. XRP’s funding rate turned negative on Wednesday and stood at -0.0040% on Thursday. 

Negative funding means short-position holders are paying longs, indicating that bearish positioning has become more aggressive.

This conflicts with XRP’s bullish long-to-short ratio and highlights the lack of consensus among futures traders.

CryptoQuant’s summary indicators point to cautious conditions across XRP’s spot and futures markets.

XRP is showing signs of overheating, while its futures market reflects sell-side dominance. Increased activity from retail traders could also introduce additional volatility if leveraged positions become crowded.

Taken together, the metrics suggest that XRP has not attracted enough consistent demand to confirm a sustained recovery.

XRP holds above the $1.25–$1.28 support zone

XRP traded near $1.30 on Thursday, maintaining a neutral and range-bound technical structure. The token remains slightly above its 50-day EMA at $1.284 and its 100-day EMA at $1.255. These moving averages create a broader demand zone between approximately $1.25 and $1.28.

The Relative Strength Index stands near 46, signaling neutral-to-weak momentum. Meanwhile, the Moving Average Convergence Divergence indicator remains below zero, showing that bullish pressure has yet to recover fully.

A break below the moving-average support cluster could expose the psychological $1 level.

The 200-day EMA at $1.353 represents XRP’s most important near-term resistance. A daily close above this level would improve the technical outlook and could open a path toward the next major horizontal resistance near $1.90.

Failure to clear $1.353 would keep XRP trapped within its current range and leave the $1.30 area vulnerable to another pullback.

Revolut says it has received no direct messages from the hackers publicly demanding a ransom over a customer data breach, even as multiple groups compete for credit and threaten further disclosures.

A faction using the name “IAmNotAVillain” demanded 6,000 Monero (XMR)—worth about $3 million—within 24 hours, according to a report by the Financial Times. On Thursday, a Revolut spokesperson told Cointelegraph that the company has not received any direct contact or demand from the individuals behind those claims.

Key takeaways

• Revolut confirms it has not received direct communication from “IAmNotAVillain” despite public ransom threats.
• A rival claimant (“Revolut Smilik”) previously circulated a far larger Bitcoin demand, widening uncertainty over who controls the stolen data.
• Investigators in Italy are broadening the probe because the suspected intrusion involves an alleged compromise or cloning of a government email account.
• Regulators are pressing banks to review access security, suggesting the issue may extend beyond a single breach channel.

Competing ransom claims muddy attribution

Revolut’s lack of direct contact matters because public ultimatums do not automatically indicate which party actually holds the data, how much has been extracted, or whether the threat is actionable. In this case, “IAmNotAVillain” is only one name attached to online claims related to the breach.

Cointelegraph previously reported that Revolut disclosed the incident last week and tied its exposure to alleged access obtained using a fake government email account. When Cointelegraph attempted to check the “IAmNotAVillain” website, iamnotavillain.xyz, it was unavailable at the time of publication.

Adding further ambiguity, an earlier group calling itself “Revolut Smilik” reportedly made a demand of 10,000 Bitcoin (about $780 million at the time), a figure dramatically larger than the later XMR demand reported by the Financial Times.

In a notice on its site, “IAmNotAVillain” disputed the competing claim, alleging that a former associate had received only a small sample of the data before taking credit for the breach. The site also warned other parties not to “deal” with the rival claimant—an escalation that typically reflects internal disputes among actors rather than proof of control over the full dataset.

Meanwhile, a cybersecurity-focused account, Dark Web Informer, also flagged another website—revoloot.lol—as associated with a separate actor claiming responsibility. That site was also unavailable when checked by Cointelegraph. Together, these competing claims make it difficult for outside observers to confidently map which group is operating the extortion pipeline.

Why Revolut’s response is significant for customers and markets

Extortion incidents increasingly unfold as a chain of claims, samples, and retractions across multiple domains—often making it hard to determine whether a victim’s infrastructure can be directly negotiated with. Revolut’s statement that it has not received any direct contact suggests the company cannot yet validate that the public demand corresponds to a party willing or able to engage with the organization privately.

For affected customers, this distinction matters because it affects expectations around mitigation. Direct communications can sometimes include specifics about the data or the steps required to verify deletion. Without that channel, customer-impact assessments and remediation efforts rely more heavily on forensic findings than on attacker instructions.

For the broader crypto audience, the ransom component underscores how extortion ecosystems increasingly mix anonymity-preserving assets such as Monero with shifting claimant identities. In practice, the exact asset and headline valuation can change faster than the underlying breach details—particularly when multiple groups are signaling from the sidelines.

Italy expands the investigation beyond a single victim

While the extortion messaging continues online, the law-enforcement angle is also deepening. According to Italian news agency ANSA reported on Wednesday, Italy’s National Anti-Mafia and Anti-Terrorism Directorate has become involved because the suspected intrusion appears to concern a government entity.

Prosecutors in Reggio Calabria have opened an investigation into unauthorized access to a computer system of public interest. Investigators are working to determine whether the institutional email account was breached outright or cloned—an important technical distinction that can affect both accountability and how the wider ecosystem was targeted.

Italy’s privacy regulator has also asked banks to urgently review the security of their access systems. The regulator is separately examining whether other banks or financial institutions may have been affected, implying that the breach method may not have been isolated to Revolut’s environment.

Earlier coverage from Cointelegraph noted that the investigation centers on a government email account allegedly used to obtain customer data. With multiple claimant narratives still unfolding online, the official inquiry remains a key reference point for what investigators can substantiate about the intrusion path.

What to watch next

Investors, security teams, and customers should watch for two developments: whether Italian investigators can confirm the mechanism behind the government email compromise or cloning, and whether any attacker claim evolves into verifiable direct contact with Revolut or corroborating evidence about the amount and scope of the exposed data.

Strategy has repurchased nearly 9.96 million STRC preferred shares for $950.8 million since July 20 as the security recovered toward Strategy’s targeted $99-to-$100 trading range.

Strategy said in its Sept. 14 SEC filing that it bought another 1,420,467 shares of its Variable Rate Series A Perpetual Stretch Preferred Stock between Sept. 8 and Sept. 13 for $139.3 million, using its USD Cash balance. The company sold no shares through its at-the-market programs and bought or sold no Bitcoin during the same period.

Adding Strategy’s eight weekly disclosures from July 20 through Sept. 13 produces 9,961,554 STRC shares repurchased for approximately $950.8 million. Bloomberg separately calculated roughly $950 million of purchases and estimated that Strategy represented around 18% of total STRC trading volume during the period.

STRC recovered from near $70 toward its $100 stated amount

STRC’s rebound followed a steep decline that had taken the preferred security to nearly $70, according to Bloomberg. The shares later reached $99.03 intraday on Sept. 14 before pulling back. STRC closed the latest completed U.S. session on Sept. 16 at $97.07 after trading between $97.01 and $97.95.

Strategy has explicitly set a corporate objective for STRC to trade between $99 and $100. Its August investor materials say management uses dividend-rate decisions, repurchases, liquidity management and issuance policy to support trading near the $100 stated amount. Strategy cautions that the target is “not a price guarantee” and says the policy can change.

The company currently pays a 12% annualized dividend on STRC, equivalent to $0.50 for each full semi-monthly period on $100 of stated value when the dividend is declared. Strategy’s board has declared $0.50 payments for the periods ending Sept. 30 and Oct. 15.

Management has said it does not currently intend to recommend changing the 12% rate until STRC demonstrates sustained trading near $100. Strategy’s existing policy is similarly not to sell new STRC below its $100 stated amount. Both policies are statements of management intent and are not contractual obligations.

That issuance policy ties STRC’s price directly to Strategy’s ability to use the preferred stock for new capital. Strategy CEO Phong Le previously said the company intended to resume issuance when Stretch returned to par, saying, “when Stretch gets back to par, we’ll issue more.” As crypto.news reported in July, management linked new STRC issuance with its ability to raise funds that could be directed toward Bitcoin purchases.

Strategy spent $950.8 million across eight buyback periods

Strategy began the current sequence by buying 288,930 STRC shares for $25 million between July 20 and July 26. The next week brought another 912,143 shares for $81.2 million.

Purchases accelerated in August. Strategy paid $108.6 million for 1,152,020 shares during Aug. 3–9, followed by $132.2 million for 1,388,720 shares during Aug. 10–16. Another 1,431,212 shares cost $136.4 million during Aug. 17–23.

During Aug. 24–30, Strategy repurchased 1,557,177 STRC shares for $151.8 million. The company bought 1,810,885 more for $176.3 million during the period ending Sept. 7, followed by the latest $139.3 million transaction.

Strategy originally authorized up to $1 billion for repurchases of its digital-credit securities in June, with STRC identified as its first priority when management considered purchases accretive. On Sept. 8, the board increased the total authorization to $2 billion, including purchases already completed.

After the Sept. 8–13 transactions, Strategy reported $1.05 billion of remaining preferred-stock repurchase capacity. Its separate $1 billion authorization for repurchasing MSTR common stock remained unused.

Strategy says purchasing STRC below $100 can retire $100 of stated value for less than that amount and reduce future preferred-dividend requirements. The company has said it intends to scale repurchases more aggressively when discounts are deeper and taper purchases as STRC approaches $100.

MSTR and Bitcoin sales supplied much of the buyback cash

Bloomberg traced roughly $765 million, or approximately 80% of the repurchase spending since July 20, to MSTR common-stock sales, including money first placed into Strategy’s cash pool before being used for STRC. Another roughly $161 million came from Bitcoin sales.

The Bitcoin-funded portion can be directly reconciled with Strategy’s SEC disclosures. During July 27–Aug. 2, Strategy sold 1,638 BTC for $104.73 million and allocated $52.3 million of those proceeds to STRC repurchases. The remaining $52.4 million funded preferred dividends.

A week later, Strategy sold 1,690 BTC for $108.6 million at an average net price of $64,262. The company said all proceeds from that sale funded STRC repurchases. Together, the two disclosed allocations equal $160.9 million, consistent with Bloomberg’s roughly $161 million calculation.

Common-stock issuance funded several later purchases directly. Strategy allocated $132.2 million of MSTR sale proceeds to STRC buybacks during Aug. 10–16, $136.4 million the following week and $151.8 million during Aug. 24–30.

For the first two reporting periods in September, Strategy funded $315.6 million of STRC purchases from its USD Cash account. The balance fell from $1.61 billion on Aug. 30 to $1.44 billion on Sept. 7 and $1.30 billion by Sept. 13. The separate USD Reserve stood at $5.10 billion.

Bloomberg cited analysts who questioned how STRC will trade once company purchases decline. Rajiv Sawhney of Wave Digital Assets told Bloomberg that “The price is the product,” arguing that STRC needs to stay near par to function efficiently as a funding instrument. Strategy itself warns in SEC filings that its repurchases and dividend policies may fail to keep the security near $100.

Strategy keeps Bitcoin at 845,050 BTC while buybacks continue

Strategy reported no Bitcoin purchases or sales for the two consecutive periods ending Sept. 7 and Sept. 13. Its holdings therefore remained at 845,050 BTC, acquired for an aggregate $63.73 billion at an average cost of approximately $75,412 per Bitcoin.

The company’s most recent Bitcoin purchase came during Aug. 24–30, when it acquired 4,603 BTC for $369.7 million at an average price of $80,318. Strategy funded that purchase with MSTR ATM proceeds during the same week while allocating another $151.8 million from common-stock issuance to STRC repurchases.

Across the July 20–Sept. 13 window, Strategy spent roughly $950.8 million repurchasing STRC compared with $369.7 million on newly acquired Bitcoin. The preferred-stock purchases therefore consumed more than twice the amount directed to new BTC acquisitions during that period.

As crypto.news previously reported, Strategy’s management had linked renewed Bitcoin financing through STRC to the preferred shares recovering toward their $100 stated amount. STRC was trading around $87 when that strategy was discussed in July.

Crypto.news reported that STRC had become the largest holding in three major U.S. preferred-stock ETFs while still trading below par in July. The report cited approximately $756 million held across the three funds at that time.

Strategy’s Sept. 14 filing leaves the next repurchase decision open. The company retains roughly $1.05 billion of authorized preferred-security buyback capacity, while its policy permits purchases to be increased, reduced, suspended or discontinued depending on STRC’s price, liquidity, available capital and other market conditions.

South Korean police have reportedly referred 18 Polymarket users to prosecutors in an illegal gambling investigation involving 26 people who collectively wagered about 17.6 billion won (worth $12.7 million). 

According to Asia Economy, data submitted by the National Police Agency to the office of Democratic Party lawmaker Yoon Kun-young showed that the Gangwon Provincial Police Agency had placed 26 people under investigation as of Tuesday and sent 18 of them to prosecutors. The report said the largest amount wagered by a single user was about 5.7 billion won ($4.1 million).

Police identified users by analyzing publicly available blockchain transactions, the report said. Polymarket lets users buy and sell contracts tied to the outcomes of real-world events and operates on a noncustodial, peer-to-peer structure with automated settlement. It does not maintain a conventional list of users by their real names, the report said. 

Authorities reportedly said Polymarket transactions constitute illegal gambling under South Korea’s Criminal Act because users stake assets on outcomes that cannot be predicted with certainty. The users argued that Polymarket should instead be treated as a crypto-based derivatives investment market, according to the report.

South Korea moves against Polymarket

In June, Gangwon police launched South Korea’s first illegal gambling probe into local Polymarket users at the request of the National Police Agency. On Aug. 18, South Korean authorities moved to block Polymarket after determining that the prediction market provided an illegal gambling environment to users in the country. 

The country’s media and communications review commission said the platform’s winner-takes-all structure encouraged speculative gambling, citing Polymarket’s role in operating markets, setting trading rules, providing crypto deposits, withdrawals, and settlement and collecting transaction fees. 

Related: CFTC, US soldier accused of illegal Polymarket bet spar over interpretation of prediction markets

Polymarket argued that it did not provide Korean-language services or support payments in Korean won and that its noncustodial transactions and use of smart contracts meant it did not directly manage user funds. The commission rejected the argument, saying technical characteristics did not exempt a service from South Korean law.

Tae-Lim Kim, managing attorney at AXIS Law, told Asia Economy that the transactions could meet the legal requirements for gambling. He said describing them as prediction derivatives would be difficult to use as a direct defense in criminal proceedings, although the ability to trade contracts and exit positions before settlement could be relevant to a court’s assessment.

Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

Z.ai forecast

H100 CEO Eirik Grøttum has increased his exposure to the Swedish Bitcoin treasury company through purchases totaling 407,163 shares for SEK 621,887, while H100 continues to report 3,506.4 BTC on its balance sheet.

H100 Group said in its Sept. 17 primary-insider disclosure that Kode Oslo AS carried out the purchases, with 405,663 shares acquired on Sept. 15 at an average SEK 1.53 and another 1,500 shares acquired on Aug. 19 at SEK 1.40. The combined average price was SEK 1.53 per share.

H100 CEO purchase lifts related holdings above 5.3 million

Kode Oslo now owns 2,771,787 H100 shares following the disclosed transactions. Grøttum serves on Kode Oslo’s board, owns 20% of the company and participates in its investment decisions, according to H100’s regulated notice.

A second associated entity, Olav Grøttum Holding AS, owns another 2,627,677 H100 shares. Grøttum owns that company entirely. Combined, the two businesses hold 5,399,464 H100 shares after the latest purchases.

The transaction concerns shares in H100 Group, not a new Bitcoin purchase by the company. H100’s disclosed Bitcoin position therefore remains separate from the CEO-related equity purchase.

Grøttum became H100’s chief executive on Aug. 11, one day after the company completed its large Norwegian Bitcoin-related acquisition. He previously served as CEO of Moonshot AS and had worked with H100 Chief Investment Officer Peter C. Warren managing Bitcoin holdings belonging to Geir Harald Hansen through Moonshot.

H100 said Grøttum’s background covers software development, quantitative trading, asset management and fintech. His appointment moved former CEO Johannes Wiik back into the chief operating officer role.

H100 still reports a 3,506.4 BTC treasury

H100’s latest company disclosures continue to place its treasury at 3,506.4 BTC. The position increased sharply on Aug. 10 when H100 completed its acquisition of NSD AS, which through a reorganization held Moonshot AS and PDI AS.

The transaction brought 2,455.37 BTC into the group, taking H100 from 1,051.03 BTC at the end of June to 3,506.4 BTC. H100 said the acquired companies had no outstanding financial debt.

No cash was paid for that acquisition. H100 issued 790,534,666 new shares to the sellers at SEK 1.86 each, representing consideration of approximately SEK 1.47 billion. The new shares increased H100’s outstanding share count to 1,128,931,358 immediately after the transaction.

The share issue represented roughly 70% of H100’s outstanding shares after closing. Geir Harald Hansen received a controlling position of approximately 69.2% through 781,676,551 shares following the deal, according to H100’s interim report.

H100 described the transaction as “the largest M&A transaction ever completed in the European Public Bitcoin Equity sector” and the first public-market acquisition completed on a Bitcoin-for-Bitcoin basis. Those descriptions are company claims and were not independently established across all European and global public-market transactions.

As crypto.news previously reported, the agreed valuation used Bitcoin at SEK 598,926.69, roughly $62,900, based on the Coinbase BTC/SEK spot price at the specified July 31 reference time. The figure was an acquisition valuation benchmark, not an open-market purchase price for 2,455.37 BTC.

Bitcoin exposure has become central to H100’s balance sheet

H100 began its Bitcoin treasury strategy on a much smaller scale. Its first purchase in May 2025 involved 4.39 BTC, after which the company raised equity and convertible financing to build its holdings.

By June 30, 2026, the company held 1,051.03 BTC before the Norwegian acquisition nearly tripled that amount. H100 describes itself as a technology company serving health and longevity providers while running an active Bitcoin treasury strategy.

The Bitcoin exposure has made H100’s reported earnings sensitive to cryptocurrency prices. Its second-quarter report showed an operating loss of SEK 88.7 million and a pre-tax loss of SEK 98.2 million. H100 said SEK 93.3 million of the pre-tax loss consisted of items that did not affect cash flow.

For the first half of 2026, the company reported a SEK 253.6 million pre-tax loss, while operating cash flow was negative SEK 12.7 million. Its equity ratio stood at 86% at June 30.

As crypto.news reported after the results, much of the quarterly accounting loss was linked to a non-cash write-down associated with Bitcoin’s lower valuation during the reporting period.

Grøttum wrote in the interim report that simply raising funds to accumulate Bitcoin was “unlikely to be sufficient on its own” for treasury companies. He said H100 planned to use capital allocation, capital-markets activity, acquisitions and operating cash flow alongside its Bitcoin holdings. The statement describes management’s strategy and does not guarantee future returns.

H100 is considering future share buybacks

The insider purchase follows a separate H100 announcement on Sept. 16 concerning new Swedish share-repurchase rules. Starting Dec. 5, Swedish public companies whose shares trade on multilateral trading facilities will be permitted to repurchase and hold their own shares. The change covers NGM Nordic SME, where H100 trades.

Grøttum said repurchases could become one of several capital-allocation options, particularly when H100 shares trade below net asset value. His comments describe a potential future tool, not an announced repurchase program.

H100 explicitly said no decision has been taken to repurchase its own shares. Any future program would require authorization from shareholders followed by a board resolution and disclosure under the applicable rules. The company’s Sept. 17 insider filing did not announce a change to its Bitcoin treasury, leaving the latest disclosed balance at 3,506.4 BTC.

The UK Financial Conduct Authority has targeted three London premises suspected of running illegal peer to peer crypto trading businesses, extending an enforcement campaign against unregistered digital asset activity.

According to the FCA, the operation was carried out on Sept. 10 alongside HM Revenue & Customs and the Metropolitan Police Service. Cease and desist letters were issued at all three locations, requiring traders to stop any suspected illegal crypto business.

Peer to peer crypto trading involves people buying and selling digital assets directly with one another. Personal transactions do not require FCA registration, but anyone conducting the activity by way of business in the UK must have the appropriate registration. No peer to peer crypto trading businesses are currently registered with the regulator.

The FCA said unregistered operators can provide a route for criminals to move and launder illicit funds because businesses operating outside its registration system avoid controls designed to detect and prevent money laundering.

“Working with partners, we continue to track and disrupt illegal crypto activity,” Steve Smart, executive director of enforcement and market oversight at the FCA, said. “Anyone running an unregistered peer-to-peer crypto business should assume we are looking at them.”

FCA expands crackdown on illegal peer to peer crypto trading

The latest operation extends enforcement activity that began earlier this year. In April, the FCA and partner agencies targeted eight London locations suspected of hosting unregistered peer to peer crypto businesses, crypto.news previously reported.

During the April 22 operation, the FCA worked with HMRC and the South West Regional Organised Crime Unit. Cease and desist letters were issued at all eight locations, while evidence collected during the inspections was retained for criminal investigations.

The regulator said evidence gathered during that operation is now being used to support ongoing criminal investigations and other enforcement action. Like the September action, the earlier inspections were conducted under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.

FCA officials have focused their enforcement efforts on businesses conducting crypto activity without the registration required under the existing anti money laundering framework. The regulator has been responsible for supervising relevant UK crypto businesses for compliance with anti money laundering and counter terrorist financing requirements since 2020.

Detective Sergeant Sathish Alalasundaram of the Metropolitan Police Service said investigators face challenges because cryptocurrencies allow funds to move rapidly across jurisdictions.

“Law enforcement and partner agencies are working significantly hard to tackle criminal activity involving digital assets,” Alalasundaram said. “The complex nature of cryptocurrency, combined with the speed at which funds can be moved across jurisdictions, presents ongoing challenges for those investigating.”

He said the Metropolitan Police continues to adapt its investigative capabilities and disruption methods as criminals change how they use digital assets.

FCA has previously pursued unregistered crypto businesses

The London operations follow several enforcement cases involving crypto businesses operating without FCA registration.

One of the regulator’s earlier cases involved Olumide Osunkoya, who pleaded guilty in September 2024 to offenses linked to an illegal crypto ATM network that processed £2.6 million in transactions between December 2021 and September 2023.

Osunkoya admitted operating crypto ATMs without the required registration, along with offenses involving false documents and criminal property. He was later sentenced to four years in prison, becoming the first person in the UK to receive a criminal sentence for unregistered crypto activity.

Separate enforcement action in June 2024 resulted in two London residents being arrested on suspicion of operating an illegal crypto exchange. Authorities believed more than £1 billion in unregistered cryptoassets had been bought and sold through the business.

The FCA inspected offices connected to the suspects, while Metropolitan Police officers searched two residential properties and seized several digital devices. Both individuals were interviewed under caution and released on bail while the investigation continued.

Enforcement continued in July 2025 when the FCA and Metropolitan Police searched four premises in southwest London. Seven crypto ATMs were seized and two people were arrested on suspicion of money laundering and operating an illegal cryptoasset exchange.

UK cryptoasset businesses providing services covered by the existing Money Laundering Regulations must register with the FCA and comply with applicable financial crime controls. Operating covered services by way of business without the required registration can lead to enforcement action.

UK crypto oversight will expand in October 2027

The Sept. 10 operation comes shortly before the FCA opens applications for the UK’s incoming crypto authorization framework.

Under final FCA guidance published on Sept. 16, applications for the new regime will open on Sept. 30, 2026. Firms seeking transitional arrangements must apply by Feb. 28, 2027, before the framework becomes mandatory on Oct. 25, 2027.

The incoming system will expand FCA oversight beyond the anti money laundering and financial promotion requirements that currently apply to much of the sector. Activities covered by the new framework include operating cryptoasset trading platforms, safeguarding cryptoassets, dealing and arranging transactions, issuing qualifying stablecoins and arranging cryptoasset staking.

Existing registration under the Money Laundering Regulations will not automatically convert into authorization under the new system. Companies already registered with the FCA will need to assess their activities and seek the relevant permissions if they intend to continue providing regulated services after the new rules take effect.

The regulator finalized key crypto rules in June covering financial resilience, market integrity, stablecoins and consumer requirements. Firms supporting customers who buy, trade or hold crypto will face standards including capital requirements and stress testing, while market integrity provisions will cover conduct such as insider trading and market manipulation.

Until Oct. 25, 2027, crypto remains largely outside the UK’s full financial services regulatory framework apart from areas including anti money laundering requirements and financial promotions. The FCA advises consumers to use its Firm Checker to establish whether a crypto business has the required registration or permissions before dealing with it.

Revolut said Thursday it had received no direct contact from those claiming responsibility for a customer data breach despite multiple public ransom demands.

A group calling itself “IAmNotAVillain” publicly demanded 6,000 Monero (XMR), worth about $3 million, from Revolut within 24 hours, threatening to sell the customer records to other criminal groups, the Financial Times reported Wednesday.

“Revolut has not received any direct contact or demand from the individuals or group making these claims,” a Revolut spokesperson told Cointelegraph.

The public ultimatum is the latest development in a data breach Revolut first disclosed last week, with Italian authorities now widening their investigation into how a government email account was allegedly used to obtain customer data.

One breach, multiple ransom demands

Revolut’s claim that it has received no direct contact adds to uncertainty over who is behind the public ransom demand, as “IAmNotAVillain” is not the only name linked to claims of responsibility for the incident. Its website, iamnotavillain.xyz, was unavailable when checked by Cointelegraph at the time of publication.

An earlier group calling itself “Revolut Smilik” reportedly demanded 10,000 Bitcoin, worth about $780 million at the time, vastly more than IAmNotAVillain’s current $3 million Monero demand.

IAmNotAVillain disputed the competing claim in a notice on its website, alleging that a former associate had received only a small sample of the data before taking credit for the breach. The site warned others not to deal with the rival claimant.

Cybersecurity-focused account Dark Web Informer also flagged another website, revoloot.lol, associated with a separate actor claiming responsibility, further complicating efforts to establish who controls the stolen customer records. The revoloot.lol website was also unavailable when checked by Cointelegraph.

Italian authorities widen Revolut data breach probe

Italy’s National Anti-Mafia and Anti-Terrorism Directorate is also now involved because the suspected intrusion concerns a government entity, Italian news agency ANSA reported Wednesday.

Related: Italy investigates government email breach linked to Revolut data leak

Prosecutors in Reggio Calabria have opened an investigation into unauthorized access to a computer system of public interest, while investigators work to establish whether the institutional email account was breached or cloned.

Italy’s privacy regulator has separately asked banks to urgently review the security of their access systems and is examining whether other banks or financial institutions may have been involved.

Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it