A flaw in Revolut US payments resulted in the theft of $20 Million

A zero-day vulnerability in the Revolut payment systems allowed threat actors to steal more than $20 million in early 2022.

In early 2022, threat actors exploited a zero-day flaw in Revolut payment systems to steal more than $20 million, reported the Financial Times quoting multiple unnamed sources.

The issue resulted from differences between American and European payment systems. When some transactions were declined, the company would erroneously refund accounts using its own money.

The problem was exploited by threat actors to steal approximately $23 million, part of this sum was recouped by the net loss was about $20 million.

The total amount of funds stolen is worrisome considering that it is equal to almost two-thirds of Revault annual net profit in 2021.

The problem took place in 2021 and threat actors began exploiting the issue in 2022. Crooks made expensive purchases that would be declined, then withdraw the refunds at ATMs. 

It seems that the problem was known in the cybercrime ecosystem.

At this time, a Revolut spokesperson declined to comment when contacted by multiple media.

In September 2022, the financial technology company Revolut suffered a ‘highly targeted’ cyberattack over the weekend, threat actors had access to the personal information of 0.16% of its customers (approximately 50,000 users).

Upon discovering the intrusion, the security team promptly locked out the threat.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Revolut)