Has Flutterwave lost $2.9 billion to hackers?

Flutterwave has self-registered as one of Africa’s most prominent fintech unicorns and an African tech poster child. But in the past year it has had to sail through stormy waves of worrying controversy. And just when we thought the storm was over, another episode started.

The latest chapter in Flutterwave’s fraught history sees the fintech unicorn in the throes of yet another storm, this time as the victim of a major hack. According to a TechPoint Africa reportan eye-popping ₦2,949,557,867 has been illegally siphoned from Flutterwave’s accounts.

Flutterwave’s legal counsel, the illustrious Albert Onimole, on February 19, 2023, notified the Deputy Police Commissioner of the State Criminal Intelligence Agency, Panti, Yaba, Lagos, of the matter. In his cover letter, Onimole explained that the malicious hackers had successfully infiltrated Flutterwave’s accounts about two weeks earlier, on Feb. 13. It was reported that the stolen money was originally moved to twenty-eight different accounts through sixty-three separate transactions.

While the incident was dutifully reported to the police on February 13, 2023, along with the full list of accounts that had received the money, it appears that the police were unable to immediately freeze the funds. In his letter, Onimole holds some commercial banks responsible for the unfortunate turn of events, as these banks allowed the money to be transferred to other accounts, widening the money trail.

SA Adedesin, the Judicial Officer of the State CID, Panti, Yaba, Lagos, filed a motion ex parte (MISC/MC4/181/23), dated February 27, in the Magistrate Court of Lagos (Yaba Magisterial District sitting in Yaba) to advance Flutterwave’s claims and further investigate accounts harboring the stolen money at various financial institutions in Nigeria. Apparently, the motion was granted in favor of Flutterwave.

The lawsuit (MISC/MC4/181/23) is between the police commissioner and a long list of financial institutions, including top lenders such as Access Bank, Zenith Bank and 25 others.

But that’s not where it ends.

While there are no documents to confirm whether the court ruled in favor of Inspector Micheal’s motion, some people have confirmed that their accounts have been frozen in connection with the hack.

A (now suspended) Twitter user listed, “I got an email from my bank stating that I am a 4th beneficiary of this much-touted fraud money. This was more than five days after a successful transaction. My account is locked can’t access the money inside. Is this correct? It’s unfair that I have nothing to do with flutter wave or the hack.”

Under the motion filed by Adebesin, 107 accounts, including the fifth beneficiaries of those accounts, will be placed under lien/Post-No-Debit (PND).

Since the stolen money has been paid out to various accounts that may or may not have anything to do with the hack, it is currently unclear who committed the hack on Flutterwave.

Questions about how the hackers managed to bypass Flutterwave’s security and what implications this will have for the unicorn’s customers linger.

However, Flutterwave is leaving the idea of ​​a hack, stating: “We have detected an unusual trend of transactions on some users’ profiles. Still, that hasn’t been enough to allay people’s concerns. Some users insist that a hack has happened and their accounts have been locked.

The case is still under development. But no matter how you look at it, there’s no question that something big happened at Flutterwave. And a superficial press statement may not be enough to allay people’s concerns.