Hackers want $3 million by tomorrow. Revolut says nobody has called. Italy has opened a file.
IAmNotAVillain put a clock on a site: 6,000 Monero (about $3m), pay in 24 hours, or the packs go on sale (FT). Reuters asked Revolut. The answer: no direct contact, no demand. The actor made the ask public. Revolut hasn't used channels to open dialogue.
In Italy, the picture moved. Reggio Calabria prosecutors have a case (LaPresse). Postal Police are on the PEC. The DNA — national anti-mafia and counter-terrorism directorate — has been looped in because a government mailbox is in play, not because anyone has proved a mafia job (ANSA). The Garante is asking other banks how they check official mail (La Stampa). Interior Ministry has not confirmed the box. Some coverage slips into “Italian hackers.” That is a jump. What they have is an Italian official channel. Who sat at the keyboard remains unknown.
The method is clearer if you take Duel / Korra, who say they spoke to the same actor. They scraped public Bitcoin addresses and txids, dumped hundreds on Revolut as a fake European Investigation Order, and asked who sat behind each one. Spray and pray, hoping they find "whales". Korra says they saw the .emls: folders with IDs, selfies, statements.
Three things in those emails should have stopped by a competent officer. 1. The envelope was a prefettura Enti locali PEC in Reggio Calabria — local-authorities admin (entilocali.prefrc
@pec.interno.it). The PDF inside looked like it was from the Postal Police / Milan procura / an EIO. Wrong address, wrong instrument.
2. An EIO in Italy is a judicial act issued by a prosecutor or judge. A prefettura cannot issue one.
3. The letterhead was wrong. Staff wrote back and told them to address Revolut Digital Assets Europe Ltd in Cyprus, not “UAB Italian Branch” (Korra). That is fixing the attacker’s homework and still fulfilling.
Three flags. A live PEC was treated as enough. A person I believe is inside the firm told me, "They are so scared of government agencies they are almost over-compliant." Revolut still will not confirm the number. FT and my other channels put it at about 680.
Nicola Vicino is GM of the Italian branch of Revolut. Not the person who hit send, but I believe he has questions to answer.
What happened. From spring to September, mail authenticated on a real Italian government domain asked for KYC. Revolut sent identity documents, selfies, statements and Bitcoin histories. Eventually, Revolut found out it was a scam, blocked the address, and told those customers. Not a hack of the app. Money stayed. Files left. People on that list are not debating PEC law. They are waiting to see if a pack with their face and their chain history is sold. Others watching from the sidelines are asking a simpler question: if official-looking mail is enough, how much of this bank is process and how much is judgment.