On 15 September, KELA Cyber published an analysis that seemed to sit slightly outside the Revolut case. Rather than looking only at how the fintech’s customer data had been obtained, it examined the infrastructure built afterwards by the actor using the name IAmNotAVillain. That is where it found something interesting. The extortion site had not been built on particularly sophisticated infrastructure. It was a static page hosted on GitHub Pages.

Following that trail, KELA identified the GitHub repositories and accounts associated with the site. One GitHub account had been created on 4 July 2026 and showed no public activity until the day of the operation. Shortly before the repository was created, the profile had been updated. GitHub does not disclose which field changed, so it cannot be said that the username or email address itself was modified. Then came the most interesting mistake.

An Outlook address remained in the commit metadata. Through that address, KELA found links to a Microsoft account registered under the name “Izael Wong”, listed in Brazil, and an Etsy account called “Calvin”. But there is an even more curious detail. The Etsy account was registered at 22:18 on 4 July. The GitHub account at 22:19.

One minute apart. For KELA, this is consistent with accounts created during the same session. But it does not mean the hacker has been identified. “Izael Wong” could be an alias. The email address could belong to a compromised account. GitHub and Etsy accounts could also have been acquired or prepared earlier specifically for use in the operation. KELA goes no further.

But the trace remains.

A site built in six hours

The Git history also tells the story of how the site came together. The repository was built in about six and a half hours on 14 September, using GitHub’s web interface. The history even preserves material the operator later tried to remove. KELA recovered references to deleted files and images. The commits also contain typos, placeholder names and extremely basic messages. One commit carries a UTC−07:00 time zone, consistent with the west coast of the United States or Canada.

It does not prove where the operator was physically located. VPNs, local settings and remote machines make that data insufficient for geolocation. It is, however, another part of the digital trail. KELA reaches an interesting conclusion: the operational capability demonstrated in the attack appears far greater than the care taken in building the infrastructure used for extortion. KELA identified another detail as well. The infrastructure included a pay. subdomain connected to GoDaddy Payments.

That is interesting because GoDaddy’s payment service normally requires identity checks, tax information and a US bank account. It could potentially provide investigators with another lead at a commercial provider.

It does not mean that the account necessarily reveals the attacker’s real identity. Stolen data or a compromised account could have been used. KELA itself presents as a possibility that the provider may hold the legal identity of the operator, or of someone whose details were used improperly.

Then the infrastructure starts moving

In the following days, the situation changes quickly. The first .xyz domains are placed on server hold, the public Telegram channel becomes unreachable, and the GitHub account linked to the infrastructure is no longer normally accessible. Meanwhile, new domains appear. On 15 September, iamnotavillain[.]com is registered. The following day, iamnotavillain[.]net and iamnotavillain[.]info also appear.

The latter two present themselves as independent information sites. But a subsequent OSINT analysis highlights something curious. The two “information” sites share graphic and structural elements with the site attributed to the actor: similar section layouts, visual elements and references to shared contact channels. This does not prove they are controlled by the same person. But it raises an interesting question.

Are we looking at independent sites documenting IAmNotAVillain, or a second infrastructure built around the same brand? The answer has not been established.

Before obtaining the files, the actor already knew whom to look for

Another detail helps explain the sophistication of the operation. The roughly 680 Revolut victims may not have been selected at random. According to an analysis published on 25 September by Arkham Intelligence, IAmNotAVillain reportedly used blockchain analytics to identify customers with significant cryptocurrency exposure in advance. That point matters.

Bitcoin is not anonymous in the traditional sense. Addresses do not necessarily identify their owners by name, but transactions, amounts and movements are recorded publicly on the blockchain.

The actor told the Financial Times that the selection was carried out through on-chain analysis, without revealing the exact method. Arkham offers one possible explanation: analysis of wallets publicly associated with Revolut and their on-chain flows may have helped identify customers with substantial crypto exposure. This is an analytical reconstruction, not a technical account confirmed by the actor (Arkham Intelligence).

The public sources reviewed do not establish that specific transaction IDs were extracted and then inserted into requests sent to Revolut. It is therefore more accurate to say that on-chain analysis may have helped select the targets; the precise step from selection to the requests remains unverified. The request sent to Revolut was therefore not necessarily generic.

According to the actor’s account and Arkham’s analysis, the attacker may already have had a criterion for identifying the customers they wanted to unmask. The blockchain may have provided a possible first indication: addresses, transactions and movements. Fraudulent requests sent through a compromised institutional channel could then have provided identifying information about the relevant customers. This is probably one of the most interesting aspects of the entire attack.

A technology built to make transactions publicly verifiable may have been used as a reconnaissance tool to identify people with significant crypto holdings. Only afterwards would the compromised Italian institutional identity have come into play. It was therefore not simply a data breach. First, a target list may have been assembled. Then a way was found to ask Revolut who those people were.

The technique: from the blockchain to KYC

The reconstructed sequence is: blockchain → wallet addresses or transaction identifiers (TXIDs) → a seemingly investigative request → Revolut → KYC documents → the people’s identities. Arkham links on-chain analysis to target selection and the deception directed at Revolut to the acquisition of identifying data, but notes that the actor did not disclose the exact method (Arkham Intelligence).

A report based on screenshots circulated by the actor describes a forged order listing deposit addresses and a response from Revolut mentioning some “hashes”. The reported screenshots do not, by themselves, establish that every identifier was a TXID or reconstruct the full selection of customers (SilereNonPossum).

The ransom changes shape

Meanwhile, the operation enters a second phase. IAmNotAVillain publishes a demand for 6,000 XMR, worth about $3 million, accompanied by an ultimatum. Revolut says it did not receive the demand or any direct communication from the group. The choice of Monero is not incidental. Bitcoin transactions are publicly observable on the blockchain, the very feature that may have been exploited to identify the victims.

Monero is designed to make transaction details, including sender, recipient and amounts, much less visible. That is not an absolute guarantee that transactions can never be traced. In other words, blockchain transparency may have been used to find the victims. To get paid, the attacker preferred Monero. Another claim had appeared before IAmNotAVillain’s demand. A party calling itself “Revolut Smilik” had demanded 10,000 BTC.

IAmNotAVillain later claimed that “Revolut Smilik” was a former associate who had obtained only a sample of the data and was trying to take credit for the entire operation. That account has not been independently verified (KELA; Red Hot Cyber). When the 6,000-XMR ultimatum expires, something even more interesting happens.

On 23 September, a dataset attributed to the case appears for sale on several cybercrime forums. The price is no longer $3 million. It is around $300,000, payable in Bitcoin or Monero. The sellers claim to have about 700 customers’ records, including KYC information and personal data. Revolut had reported 680 affected customers.

The two numbers should remain distinct: 680 is the figure reported in connection with customers affected/notified, while roughly 700 is the quantity claimed by the sellers. Threat-intelligence sources observed the offers; the authenticity and completeness of the full archive remain unproven. At the same time, the actor’s site displays another option. “BUY EXCLUSION OF YOUR DATA”. The archive is therefore not the only thing being monetised.

Each individual victim can also be turned into a customer of the extortionist by paying to have their data excluded. The operation now has three distinct layers. First, the ransom demanded from the company. Then, the sale of the database. Finally, the individual extortion of people whose data is in the database.

And Bitcoin ends up playing several different roles in the same story. It may have been used indirectly as an intelligence source through blockchain analysis. It appears in the demand attributed to Revolut Smilik. And it is ultimately accepted, alongside Monero, as payment for the alleged database.

But on 25 September, the story changes again

Until then, one of IAmNotAVillain’s hardest claims to verify remained unresolved. The actor said they had also stolen about 147 GB of material belonging to Italian institutions, comprising tens of thousands of files. Italian authorities had not confirmed that account as of 18 September (Red Hot Cyber). On 25 September, however, a new section appears on the leak site.

A section called “Italy files”. Sources that saw previews report about 85,000 files. A 25 September report also says the actor began publishing the collection, claiming about 150 GB and more than 85,000 files; it also reports claims involving more than 130,000 public officials. These figures and document categories are attributed to the collection and the actor’s claims; they do not independently verify the full archive.

The entire archive was not yet available. Only samples could be seen. Those samples were described as documents attributed to the Interior Ministry and the Ministry of Justice, communications concerning diplomatic passports, information about law-enforcement personnel, authorisations, health documentation and visa applications. The material has not been independently authenticated. That point is essential. But something has changed.

Before, there was only the attacker’s claim to possess tens of thousands of Italian documents. Since 25 September, samples that the actor says came from the archive have also been reported. Their appearance alone does not prove the files’ provenance, authenticity or completeness.

The interesting coincidence

This is where the story that began with KELA becomes even more interesting. On 14 September, someone builds an extortion site in a few hours, leaving behind a public repository, an email address in the commits and accounts that can be linked to one another. KELA finds the trail. In the following days, that first infrastructure is gradually abandoned or made inaccessible. But the operation does not disappear.

It moves. The domains and channels change. The Revolut database appears on underground markets. Individual extortion appears. And finally, the “Italy Files” are shown.

The question is therefore not only who IAmNotAVillain is. It is another one.

Is the person who left those GitHub traces the same one now controlling the operation, or are we seeing infrastructure that has passed through several hands?

The doubt is not theoretical. A second party, “Revolut Smilik”, has also appeared around the breach and claimed responsibility for the operation. IAmNotAVillain says this was a former associate who obtained only part of the data and later presented themselves as the attacker. There is not enough public evidence to establish which account is true. That is precisely why it is dangerous to turn “Izael Wong”, “Calvin” or any other alias found through the infrastructure into a real-world identity.

We may have found a trace of the attacker. Or a trace of the extortionist. Or the digital identity of someone who did not carry out the initial intrusion.

What we know today

The most interesting part of the story may therefore not be only the vulnerability that allowed Revolut’s data to be obtained. It is what happened afterwards. An operation that began by exploiting the digital identity of an Italian institution turned into a public campaign of extortion, data sales and pressure on individual victims. In the middle of it all, a surprisingly visible digital trail remained. GitHub.

An Outlook address. Accounts created sixty seconds apart. Domains registered one after another. Channels that disappeared. New sites.

A second party claiming the attack. Blockchain analysis reportedly used, according to the actor’s account and Arkham’s reconstruction, to help identify victims in advance. Bitcoin. Monero. And now the “Italy Files”.

None of these elements, by itself, identifies IAmNotAVillain. Taken together, however, they tell a story that the simple headline “Revolut data breach” does not.

Perhaps the attack ended months ago. The investigation into the identity of whoever turned it into extortion may only just have begun.

Sources and timeline

The timeline below distinguishes official statements from journalistic reporting and claims made by the actor. Claims by the actor and sellers are not treated as independent proof.

March–July 2026, reported on 17 September
The premises of a Senate parliamentary question report email exchanges between Revolut and the perpetrators during this period; the document also refers to screenshots of a 24 July email about transmitting documents and their password. This is an account contained in a parliamentary question, not government confirmation of how long the mailbox was compromised. Italian Senate, question 4-03368.

12 September 2026
Revolut confirms that it disclosed customer data to a third party that had submitted fraudulent requests using a legitimate government email domain. The company says its systems and customers’ funds were not compromised; it initially describes the number of affected customers as limited. Reuters, 12 September.

14 September 2026
KELA publishes its OSINT analysis of the extortion site: GitHub Pages, public repositories and metadata, file history and a GoDaddy Payments subdomain. The analysis links some accounts but warns it is not established whether they belong to the actor, were compromised or use aliases. KELA, updated 15 September.

15 September 2026
Corriere della Sera reports that the fraudulent request allegedly came from a compromised certified email account linked to the Prefecture of Reggio Calabria; according to sources cited by the newspaper, about 680 customers had been notified, a figure Revolut had not then confirmed publicly. Corriere della Sera.

16–17 September 2026
IAmNotAVillain publishes a demand for 6,000 XMR; Revolut says it did not receive the demand directly. The amounts and deadline are the actor’s claims; the company’s position is reported in the press and in its statement. Red Hot Cyber, timeline updated 24 September.

18 September 2026
In a parliamentary response reported by RaiNews, the Undersecretary for the Interior says ACN/CSIRT analysed a sample email and confirmed compromise of the PEC; the response gives 680 affected users, eight of them Italian. This is an official confirmation of the compromised channel and the figure reported for the Revolut case, not a confirmation of the “Italy Files”. RaiNews, 18 September.

23 September 2026
Red Hot Cyber reports sales listings for about 700 records at roughly $300,000 in XMR/BTC and the option “BUY EXCLUSION OF YOUR DATA”. The existence of listings is reported based on observations and threat-intelligence sources; the authenticity and completeness of the database are unconfirmed. Red Hot Cyber, update of 24 September.

25 September 2026
Arkham publishes its analysis of on-chain target selection. The actor’s statement to the Financial Times refers generally to “onchain analysis”; the specific explanation involving Revolut wallets and flows is Arkham’s interpretation. Arkham Intelligence.

25 September 2026
A TechNadu report says the “Italy Files” were published, with figures and categories attributed to the actor, but notes that Italian authorities and security companies had not independently verified their authenticity and scope. TechNadu.

Update note: This is a snapshot of sources checked on 26 September 2026. The estimates “680 customers”, “about 700 records”, “147/150 GB”, “85,000 files” and “over 130,000 public officials” come from different sources and have different verification levels. The article attributes them accordingly; they should not all be read as quantities confirmed by an authority.