Mark Karpelès on the Revolut case: they should not have sent the information
- Karpelès criticizes that Revolut did not first confirm the request with the requesting agency.
- High-profile user data was leaked to alleged bad actors.
The former CEO of the now-defunct bitcoin (BTC) exchange Mt. Gox, Mark Karpelès, lashed out at the neobank Revolut for leaking private data of its clients.
Karpelès criticized the platform for not confirming the request with the requesting agency before processing the mass delivery of confidential information.
The incident was triggered when the financial entity proceeded to deliver records after receiving an allegedly official email, which turned out to be an advanced identity theft that compromised the privacy of its clients.
According to the entrepreneur's statements, the financial institution made a "serious methodological error" by responding to the request immediately and relegating verification to a
Revolut should not have sent customer data (KYC, historical data, etc.) in response to an email just because it came from a government agency.
Mark Karpelès, former CEO of Mt. Gox.
Indeed, high-profile user data from Revolut was leaked to alleged bad actors due to this failure in prior verification protocols.
The transferred information includes personal identification data, such as full names, dates of birth, home addresses, copies of official documents with photographs, bank statements with IBAN, detailed records of withdrawals, and the complete transaction history executed on the platform, as reported by CriptoNoticias.
In addition to personal data, Revolut provided BTC transaction histories of several clients, which increases the risk of phishing attacks against the neobank's users.
In short, Revolut should not have sent customer data (KYC, historical data, etc.) in response to an email just because it came from a government agency. https://t.co/mhEqMmUZjW
--- Mark Karpelès (@MagicalTux) September 13, 2026
"Was Revolut right?"
The legal analysis presented by the former Mt. Gox executive indicates that the argument of acting under a reasonable belief lacks legal backing within the regulations of the European Union.
Karpelès questioned the neobank's stance by publicly asking: "Was Revolut right to disclose information based on an email?".
Unlike U.S. legislation---where provision 18 U.S.C. § 2702(b)(8) contemplates emergency data requests based on the good faith of the provider---the regulatory framework of the countries where Revolut operates imposes strict banking secrecy. Under Article 6.1.c of the GDPR, any data transfer requires a prior legal obligation and does not admit good faith justifications.
In Lithuania ---the country regulating Revolut--- Article 55 of the Banking Law requires written requests transmitted through previously agreed channels and sets a formal legal deadline of up to 20 days to respond.
Similarly, in France, authorities like TRACFIN channel their requests through authenticated platforms like ERMES, and the CNIL's Guide to Authorized Third Parties mandates prior verifications (such as a confirmation call).
For all these reasons, any justification for processing an unauthenticated request immediately is ruled out.
Furthermore, Karpelès emphasized that the practical guidelines from personal data protection agencies clearly specify that entities cannot validate requests based on contextual elements or the mere appearance of the sender.
In fact, the basic protocol for email requests requires direct verification contact with the public institution through independently published official communication numbers or channels.
This case highlights the advancement of social engineering and the increasingly precise tools of hackers and attackers, who have managed to bypass controls and barriers to access privileged information. Hence, the relevance of optimizing security processes through automated tools and artificial intelligence (AI), as specialists have suggested to this medium.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

BlackRock says Bitcoin volatility fell to 35–40

Gemini Hacks Three Companies Autonomously: What It Means

EU staking review threatens crypto yields and network security could pay the price

Toyosa adds BTC alongside USDT for Toyota purchases

Bitcoin: VanEck Criticizes Metaplanet's Compensation Model

Stablecoin salaries can leave workers paying to access their wages
![[Coin Crime] "If you give us Tether, we will give you oil" - Polish state-owned company falls victim to international fraudsters](/public-static/18_26310349ce.png?format=avif)
[Coin Crime] "If you give us Tether, we will give you oil" - Polish state-owned company falls victim to international fraudsters

Why real-time election odds are misleading prediction market crypto traders

Ripple says asset managers prepare for XRPL Batch

Kevin O'Leary, the 'Shark' of Canadian Business, Names the Main Threat to Bitcoin on Its Path to $1 Million

From Stablecoins to Consumer Finance, ENA is Gaining New Valuation Logic

Caught Off Guard? Anthropic Forced to Release Model Early After Just Calling for a 'Slowdown'

Who Benefits from Interest Rate Hikes? Clarity Act's Failure Due to Established Interests

Cryptocurrency Bill Fails, Fed Raises Rates, Yet Bitcoin Rises?

Bitcoin: JPMorgan Sees BTC Outperforming Gold

Why the Robinhood Chain Boom Has Not Led to Growth in the Ethereum Mainnet

Circle wants you to love USDC a little like you love Chelsea

Grayscale Is Making Its Red-Hot Zcash ETF More Affordable

Wyoming: LayerZero Loses State Stablecoin, Chainlink Takes Over

BlackRock Executive: Bitcoin Volatility Halved, Shifting from 'Get-Rich Narrative' to 'Collateral Narrative'

Crypto: The 2026 Ranking of the 36 Most Favorable Countries for Adoption

Ethereum's Next Upgrade May Become the Most Significant Catalyst in History

Web3 Newsletter: Industry Highlights and Must-See Trends This Week

Cryptocurrency Security Guide: How to Identify and Prevent Social Engineering Attacks

Why SBI just put millions behind a Singapore startup’s stablecoin push

Tokenized stocks face 24/7 pricing gap: RedStone COO

Bitcoin Will Hit $1 Million, Says Kevin O’Leary—But There’s a Quantum Catch

Fraud Detection with AI SEON: Signals Rise from 900 to Over 1,100

WEB3 Digital Nomads Don't Need a U Card That Only Allows Payments









