Revolut KYC Data Breach: How ZK KYC Reduces Exposure
September 16, 2026
9 mins read
The Revolut KYC data breach sent passports and transaction data out through one fake request. ZK KYC lets services check one fact instead.
TL;DR: The Revolut KYC data breach showed how one fake request can expose passports, selfies, contact details, and transaction history. ZK KYC reduces how many systems hold that data by letting services check one fact, such as valid KYC status or age, through a Zero-Knowledge Proof instead of receiving the documents.
Banks and fintechs keep full identity files because regulation requires it, and the Revolut KYC data breach shows what happens when such a file leaves through a channel everyone trusts. According to Revolut, an unauthorized party used a legitimate government agency email domain to send fraudulent information requests, customer data was sent in response, and the company's systems and customer funds were unaffected.
What did the Revolut KYC data breach expose?
An impersonation request pulled a near-complete identity and financial profile out through a channel the company trusted.
Revolut described the incident as a "sophisticated external impersonation scam." A notification reviewed by TechCrunch listed birth dates, postal and email addresses, phone numbers, and copies of passports or driving licenses, and said the exposed data may also have included verification selfies, account statements, and transaction histories. Revolut said a limited but undisclosed number of customers were affected.
Centralized KYC turns one mistake into a full identity leak
When identity documents sit next to account and transaction data in one file, a single wrong disclosure reveals far more than the requester needed to check.
Banks collect passports and face images because onboarding rules require reliable identification. The exposure grows later, when partners, product teams, or outside parties are answered with a copy of that file. Encryption protects the file while it is stored or sent, and access controls decide who receives it, but once a request is approved, neither limits what the file contains.
A different model lets the institution check only the fact it needs, such as whether a user is over 18, without holding the personal data behind it, so a breach has less to expose. The same idea underpins AML/KYC without mass surveillance, where routine checks get the smallest answer that settles the decision and full identity files sit behind a separate, controlled process.
How does ZK KYC reduce raw-data exposure?
ZK KYC splits identity checks into two steps: a trusted issuer checks the documents once, and every later check uses a proof of one fact instead of a copy of the file.
In the first step, a bank or KYC provider checks the customer's documents the way it does today and issues a credential, a signed digital statement of facts such as KYC status or investor eligibility. The W3C Verifiable Credentials Data Model 2.0 defines the roles in this model, including the issuer who signs the credential, the holder who keeps it, and the verifier who checks it.
In the second step, when a service needs to know something, the customer's digital wallet creates a Zero-Knowledge Proof, a piece of cryptography that shows a statement is true without revealing the data behind it, and the service receives only a yes or no answer. In July 2025, Google named German Sparkasse banks as the first national credential issuer for its EU age checks, with the aim of letting a service confirm a fact such as "is over 18" or "holds a valid ID" without handling the user's personal data.
| What the service needs to know | Conventional answer | ZK KYC answer |
|---|---|---|
| Is the customer over the required age? | Date of birth or a copy of the ID | A yes or no proof that the age check passes |
| Has the customer passed KYC? | The KYC file or the provider's statement | A proof that the customer's credential is on the issuer's list of valid credentials |
| Is the credential still valid? | Ask the issuer and trust the reply | A proof checked against the latest version of that list |
| Is the investor accredited? | Identity and supporting documents | A proof that the investor is on the list of accredited investors |
The issuer still holds the original documents and hands them over when the law requires it, so ZK KYC cuts the number of systems that keep copies while the KYC process itself stays in place. Deutsche Bank's 2024 proof of concept with Privado ID found that proofs made checks of single facts easier, while the institutions on the other side still had to go through detailed and costly KYC processes.
How zkDatabase is designed to prove credential state for ZK KYC
zkDatabase is designed to hold the issuer's list of valid credentials and prove that a given credential is on it, without revealing any identity data.
Many tokenized asset platforms keep KYC status in allow-lists, registries of approved addresses that an operator updates, so a verifier has to trust that entries were added and removed correctly. zkDatabase, a verifiable database powered by Zero-Knowledge Proofs, generates a proof for every operation, so anyone can verify the database's integrity without trusting the operator. It proves how the data was processed, while checking that the underlying documents are genuine stays with the issuer.
The valid credentials are committed as a Merkle root, a short fingerprint of the whole list that changes when the list changes. zkDatabase wraps the Merkle membership check inside a Zero-Knowledge Proof, so the verifier learns only that the credential is on the list, without seeing the Merkle path or the credential's position.
The issuer keeps the documents, and other services check a proof against the current list of valid credentials.Issuers add credentials with a proof that each insertion was correct, and a revocation publishes a new root without the revoked credential, so a proof against the old root no longer shows current validity. Past roots give an audit trail of which credentials were valid at a given time, without exposing personal data.
Orochi Network's partnership with zkPass puts zkDatabase behind a user-side proof tool. zkPass lets users prove attributes such as KYC status without revealing the underlying data, but each proof covers a single check at one point in time, and zkDatabase adds a provable backend that anchors those claims in a tamper-proof data state. The zkPass and zkDatabase integration explains how the two fit together.
ZK KYC makes a verified status reusable
If one verified status can be checked by many products or institutions, customers do not have to send their identity documents to each of them.
Today, an investor who joins a new platform often has to submit the full KYC file again. With a reusable credential, a customer who passed KYC at Bank A could show Bank B a proof that they hold a valid, non-revoked credential, and Bank B would never see the original documents. The same pattern fits an accredited investor proving eligibility for a tokenized fund, or a customer proving valid KYC before joining a DeFi pool open only to verified users.
Each verifier still decides which issuers and credential formats it accepts, as the ZK KYC and decentralized identity guide explains in more detail, and the Verifiable Credentials guide covers the underlying standard.
ZK KYC shrinks the blast radius of a KYC data breach
ZK KYC cuts how often a full identity file is shared and how many systems keep a copy, which reduces what a single leak can expose.
The Revolut incident involved the company that holds the original file, and ZK KYC does not change that part. The issuer still keeps the documents and still has to answer legal requests, so a fake request that passes its checks can still pull out a full file. Strong verification of who is asking remains the control for that path.
The gain sits in the routine traffic around the issuer. When partners, product teams, and other services receive proofs instead of copies, fewer systems store passports and selfies, fewer people and vendors are in a position to send them out, and a breach at any of those systems exposes a yes or no answer instead of an identity file. The full file stays in one place behind one controlled disclosure path, which is easier to guard than many scattered copies.
Key Takeaways
- The Revolut KYC data breach came from a fraudulent request sent through a legitimate government agency email domain, and Revolut says its systems were not broken into.
- Centralized KYC files link identity documents, face images, and transaction data, so one wrong disclosure exposes all of them.
- ZK KYC does not stop the issuer from answering a fake legal request, but it cuts the number of systems holding copies of the file.
- ZK KYC lets services check one fact through a Zero-Knowledge Proof instead of receiving a copy of the file.
- zkDatabase is designed to prove that a credential is on the issuer's current list without revealing personal data.
Conclusion
The Revolut KYC data breach points to a weakness that stronger perimeter security alone does not fix, since any approved request against a full identity file can release everything in that file.
ZK KYC keeps the documents with the issuer and gives other services a proof of the one fact they need, and zkDatabase is designed to add proof that the credential list behind that answer is current and was updated correctly.
Explore zkDatabase
See how zkDatabase handles credential state without exposing identity data.
FAQ
How would ZK KYC reduce the impact of a KYC data breach?
ZK KYC reduces the impact of a KYC data breach by limiting routine checks to proofs of single facts, such as valid KYC status or age. Services that only receive proofs never hold copies of passports, selfies, or full identity files, and the original issuer keeps the regulated documents, which leaves far fewer systems with identity data that could be exposed.
What does zkDatabase do in a ZK KYC setup?
In a ZK KYC setup, zkDatabase is designed to hold the issuer's list of valid credentials as a Merkle tree and generate Zero-Knowledge Proofs that a credential is on that list. A verifier checks the proof against the published fingerprint of the list without seeing any personal data, while the issuer remains responsible for checking that the underlying documents are genuine.
Can one KYC check be reused across institutions?
A KYC check can be reused only where the verifier accepts it. A customer can create a new proof from the same credential for each service, but each bank or platform decides which issuers, credential formats, and rules it trusts. Only the verified fact moves between services, and each check runs against the current version of the issuer's list.
Related to
