Jason Mikula

Apart from the obvious, couple items in this scoop from @theinformation's @michaelroddan on Erebor's plans to operate in Syria that caught my eye: First, it is worth acknowledging the legal situation regarding facilitating or conducting financial transactions with persons in Syria and Venezuela, in which Erebor also has started to do business, have changed. In 2025, the U.S. issued new general licenses for and terminated sanctions programs targeting Syria, repealed the Caesar Act, waived application of the Syria Accountability Act in relation to certain items on the Commerce Control List, revoked the designation of al-Nusrah Front as a foreign terrorist organization, and took other actions to facilitate the reintegration of Syria with the global financial system and economy. However, while the relaxing of sanctions and related measures makes it possible to facilitate financial transactions with Syrian persons, real financial crime risks remain. Some targeted sanctions, aimed at Assad-regime members, drug traffickers, and human rights abusers remain in force. Money laundering and terrorist financing risk remain elevated. And Syria remains on the FATF's "grey list," though that is in part because the security situation in Syria has prevented on site visits to confirm reforms such as criminalizing terrorist financing and setting up asset-freezing procedures have been implemented and maintained. In Roddan's piece in The Information, he describes Palmer Luckey, a defense contractor and backer of Erebor, as explicitly viewing Erebor's move as supporting U.S. government policy. Andreessen Horowitz and Peter Thiel's Founder Fund, both of which have also been vocal supporters of the current administration, have also invested in Erebor. Roddan writes, "Luckey, meanwhile, recently told staff at a companywide meeting that Erebor was working toward playing its own part in reconnecting Syria to the global financial system, emphasizing that the bank was interested in supporting U.S. foreign policy, according to people familiar with the remarks." Citing remarks in the same all-hands meeting, Rodan writes that "Erebor could possibly even eventually supply financial services to places such as Cuba as well as North Korea, where Luckey said he believes the Trump administration could broker a peace deal permitting North Korea to keep its nuclear weapons."

After going quiet last Thursday 9/17, the @Revolut hacker is back, with a "dark web" TOR site offering data on 680 crypto "whales" for sale: The group, still operating under the name "ImNotAVillain," messaged me directly this morning on encrypted messaging app Session, sharing a TOR address (shown below, redacted by me) and new Telegram channels. Previous traditional websites and Telegram channels were repeatedly deactivated, apparently for terms of service violations. On the TOR site, the group offers impacted users, which include former Mt. Gox CEO Mark Karpelès and founder of online gambling site Gandom Felix Romer, the ability to pay to have their information removed (though, to be clear, there is no mechanism by which such a deal could be reliably verified or enforced). In one of the Telegram channels the group created, they appear to offer to sell the entire cache of Revolut user data for just "300k... 10x cheaper then what the ransom was," which would seem to confirm my earlier analysis that the group is struggling to monetize the data they have exfiltrated. The group also posted in the same Telegram channel, "More on 🇮🇹 and a few companies that met the same fate as Revolut coming soon on our website," seemingly implying the Italian government itself and other companies may have had data compromised using similar attack vectors.

Binance, the one being probed over Iran sanctions evasion, per Bloomberg’s reporting today? https://t.co/pseyRcnGwf

"The blood will be on your hands," the @Revolut hacker warned last week, threatening to begin selling users' information if the bank didn't pay a $3 million ransom: What may have at first seemed like just another data breach ricocheted across the internet and Europe last week, with a group operating under the name IAmNotAVillain threatening to sell identity information and account balances and transaction histories, including crypto, of about 680 Revolut users. The users whose data were compromised appear to have been targeted because they are crypto “whales,” an industry term used for those who own significant amounts of cryptocurrencies. Crypto "whales" have increasingly become targets of kidnapping, extortion, and other threats. IAmNotAVillain said that, if the ransom demand was not met, they would sell the data — potentially compromising the physical safety of the users — and warned “the blood will be on your hands.” Documents, screen captures, and a video shared by the hacker appear to indicate that they exploited an official Italian government email system to send forged legal requests to Revolut requesting users’ data. The hacker appears to have then used forged European Investigation Orders, sent from the compromised Italian Ministry of the Interior email address, to request account and transaction information associated with specified wallet addresses. The framework for issuing and fulfilling a European Investigation Order is defined by Directive 2014/41/EU, as amended by Directive 2022/228. Per this framework, such orders can be issued by a judge, court, investigating judge, or public prosecutor competent in the case. In the image of the EIO circulating online, which has not been independently verified as what was sent to Revolut, the authority specified is the “Public Prosecutor’s Office at the Court of Milan” — even though the email account it appears to have been sent from is associated with the Italian Ministry of the Interior, and specifically the locality of Reggio Calabria, more than 1,200 kilometers from Milan. The legal framework for such requests describes transmitting an EIO from an issuing authority — the Public Prosecutor’s Office at the Court of Milan, in the case of the apparently forged document shown above — to an executing authority in the target country. An “executing authority” would be a state actor defined by relevant national law, not Revolut itself. In the case of Lithuania, where Revolut’s bank entity is based, it appears the proper executing authority for an EIO related to a pre-trial investigation would be the Prosecutor General’s Office. The incident comes at a sensitive time for Revolut, which, having received conditional OCC approval, is in the process of operationalizing its U.S. charter. The company, valued at $110 billion, is also plotting an IPO, though Revolut cofounder and CEO Nik Storonsky said a public offering wouldn't take place til at least 2028.

This is why we ̶h̶a̶v̶e̶ ̶ had securities regulations... https://t.co/Bs2FE2Av08

Scoop: pay-by-bank startup @Trustly has laid off about 24% of staff, 205 roles, I can exclusively report. Trustly clients include Coinbase, T-Mobile, MoneyGram: The company appears to have informed employees yesterday, with Trustly CEO Johan Tjärnberg writing in an email to employees that I've obtained, "We are not meeting the opportunity in front of us with the level of execution it demands. The way we are set up has made it harder than it should be to deliver: structures have become too complex, work is duplicated, ownership is unclear, and investment is not aligned with our priorities." While Trustly has grown revenue by loosening risk controls in order to increase approval rates in the U.S., adjusted EBITDA has shrunk as losses have grown, a Q2 presentation to bondholders shows (image below). Trustly reported adjusted EBITDA of SEK 42 million in Q2 (about USD $4.3 million), a sharp decrease from SEK 85 million ($8.65 million) in Q2 2025. The company had negative SEK 261.7 million ($26.6 million) cashflow for the first half of 2026. "Management are very focused on liquidity, with multiple levers available," the Q2 2026 bondholder presentation said. The layoffs primarily impacted the Brazil operations, with all or nearly all of that team terminated. Key legal and compliance staff in the U.S. were also impacted, sources with knowledge of the matter told me. Trustly operates in the U.S. via money transmitter licenses; a review of NMLS shows it holds such licenses in at least 41 jurisdictions. An impacted employee in Canada described the Canadian branch of Trustly as having been "dissolved." A Trustly spokesperson confirmed the layoffs, saying, "We've shared proposed organizational changes with our employees that impact around 200 roles globally. These changes are about sharpening our focus and concentrating investment behind the priorities that will help us lead the rapidly growing open banking market. We understand the impact this will have on those whose roles are affected, and we’re supporting every employee throughout the process."

High-APR lender @enova abandons $369 million @grasshopperbank deal, cites regulatory uncertainty, "political pressure and outside advocacy" Chicago-based Enova announced it is withdrawing its applications to the OCC and the Federal Reserve related to its proposed $369 million deal to acquire of Grasshopper Bank. (Full disclosure, I worked at Enova from 2011-2013). The proposed acquisition was announced in December 2025. Enova operates multiple consumer and SMB lending brands, including CashNetUSA, NetCredit, and OnDeck, via state licenses and bank lending partnerships. Rates on its consumer products reach into the triple digits, driving a number of consumer advocacy groups and politicians to publicly oppose the deal. Senators Elizabeth Warren (D-MA) and Chris Van Hollen (D-MA) to the OCC and the Fed this May. A group of 20 state attorneys general followed suit, arguing that granting bank privileges to high-cost lenders like Enova "should be cause for alarm." Consumer advocacy groups, including the Center for Responsible Lending, the National Consumer Law Center, the National Community Reinvestment Coalition, and the Woodstock Institute, among others, also voiced opposition to the deal. In a call held yesterday, Enova's CEO, Steven Cunningham, commented on the decision, saying, "[T]he bank application process has not evolved enough to clearly articulate the standards for nonbanks like Enova, who serve customers whose credit needs have traditionally been met mostly outside of the banking system. Without these clearly articulated standards, the process is susceptible to influence political pressure and outside advocacy, independent of the merits of the application itself." In response to questions on that call, Cunningham emphasized Enova continues to have a strong and diversified funding strategy, and that access to deposit funding was not the primary motivator for the deal. Cunningham also clarified that neither the Fed nor the OCC took any decision on the applications before them. Reiterating that there are not "clear guidelines" for such applications from non-traditional lenders like Enova, Cunningham added, "[O]thers have seen these in the past, you face a long, costly, time-consuming back and forth of additional requests or you could face the potential for conditions that fundamentally change your business or you could face flat-out denials in addition to approvals." Fellow Chicago-area high APR lender OppFi is also in the process of attempting to secure OCC and Fed approval of its proposed acquisition of BNCCORP and its subsidiary, BNC National Bank, in a $130 million deal announced in April 2026. OppFi has faced similar opposition to its proposed acquisition, and, as of now, the deal remains pending, awaiting regulatory approval.

Revolut comms/PR team officially having the worst week ever... https://t.co/peDtcwugIP

When I was looking at CinCin, a Russian "no KYC" app (that offered to bribe me to take down my story), Sunrate's UK and Hong Kong entities were the ones issuing cards. I reached out to Sunrate when reporting that story & never got a response. That write up is here: https://t.co/MijvSWP4tK

Revolut staff fell for an email that seems to have spoofed a legitimate gov't email and turned over user info, including identity document, "selfie" verification, and account balances / transaction records (including bitcoin): https://t.co/wvQTjb6rLj