Four Breaches in Fourteen Months: Anatomy of Flutterwave's Unauthorized Transfers
Introduction
Between February 2023 and April 2024, Africa’s most valuable fintech — Flutterwave, the Nigerian payment processor valued at $3 billion — was hit by four separate unauthorized-transfer incidents totaling roughly ₦33 billion (about $44 million at then-current rates). Court documents, insider accounts, and contemporaneous reporting assembled by TechCabal and TechCrunch tell a consistent story: attackers repeatedly moved money out of the payment hub through dozens of accounts across dozens of banks, and in at least one case they deliberately kept deposits below the limits that would trigger fraud checks.
Why this matters Payment infrastructure is a concentration point: one hub, millions of merchants, and every bank in the ecosystem downstream of it. When a hub’s controls fail, the blast radius is measured in banks, not accounts. Flutterwave’s incidents are the clearest recent anatomy of how that plays out — and what fintechs anywhere (Kenya included) should do about it.
The anatomy: four incidents in fourteen months
| # | Date | Reported amount | How the money moved |
|---|---|---|---|
| 1 | Feb 2023 | ₦2.9B (~$4.2M) | 63 transactions across 28 accounts, then spread to 107 accounts in 27 banks |
| 2 | Mar 2023 | ₦550M | Diverted to ~107 accounts in 27 banks |
| 3 | Oct 2023 | ₦19B (~$24M) | Unauthorized POS-merchant transactions; ~6,000 account holders across 35 banks |
| 4 | Apr 2024 | ₦11B ($7M), insider says ≥ ₦20B ($13.5M) | Moved to accounts in 5 financial institutions over 4 days |
February 2023: the ₦2.9 billion API trail
In early February 2023, unknown actors moved over ₦2.9 billion (~$4.2 million) out of Flutterwave accounts. Per documents reviewed by TechCrunch, the funds crossed 28 accounts in just 63 transactions — a small count, enormous value, classic mule-network laundering. Flutterwave’s legal counsel petitioned the police on February 20, 2023 for court orders to freeze 107 bank accounts in 27 banks that directly or indirectly received the funds, according to certified court documents seen by TechCabal. Hundreds of customer accounts ended up frozen as banks enforced Post-No-Debit (PND) liens.
Flutterwave denied being hacked, saying its transaction monitoring and 24-hour fraud desk flagged “an unusual trend of transactions” during a routine check. The leading theory was social engineering of merchant credentials: merchants’ API keys compromised, letting attackers move funds sitting in merchant settlement balances. The incident’s footprint — merchants’ keys, not core banking — is the first clue to what kind of control failed.
March 2023: ₦550 million more
A month later, about ₦550 million was diverted to accounts in the same pattern — roughly 107 bank accounts in 27 banks, per the same court documents. The recurrence within weeks is the tell: whatever gap was exploited in February was not closed by March.
October 2023: the ₦19 billion POS incident
In October 2023, about 6,000 account holders across 35 banks and financial institutions received ₦19 billion (~$24 million) transferred through unauthorized transactions by POS merchants, per TechCabal’s reporting. Flutterwave later obtained a court order to recover the $24 million — a recovery that worked because every movement left a ledger trail (the same property that made NCBA’s and Flutterwave’s clawbacks possible, as we covered in Reconciliation Analytics: When the Money Doesn’t Match).
April 2024: ₦11 billion, kept under the radar
One month after that recovery order, another breach. Per insiders cited by TechCabal, perpetrators transferred ₦11 billion ($7 million) — one insider said at least ₦20 billion ($13.5 million) — to accounts in five financial institutions over four days. The incident likely went undetected because the perpetrators ensured the deposits remained below limits that would trigger fraud checks. Flutterwave said it detected “unauthorized activities inconsistent with usual customer behavior on one of our platforms used by a small subset of our customer base,” and insisted no customer funds were lost. In February 2024 it secured a Mareva injunction to recover funds and assets from identified account holders — aided by the Central Bank of Nigeria’s mandate (effective March 2024) requiring BVN or NIN for account opening, which made the mule accounts attributable.
What the pattern tells us
- Concentration risk is real. Four incidents in fourteen months against one hub is not bad luck — it is a target that attackers kept probing until controls moved. Fintechs with large settlement balances are high-value, high-repetition targets.
- Fragmentation is the laundering signature. 63 transactions, 107 accounts, 27 banks. Single-transaction limits and per-account checks see nothing; the pattern only appears when you look at velocity across accounts and banks.
- Threshold evasion is the detection gap. “Deposits below limits that would trigger fraud checks” means the attackers had read (or guessed) the monitoring rules. Static thresholds are a spec sheet for attackers.
- Merchant-key compromise points at API hygiene. If the February theory is right, the crown jewels were API credentials with too much power and too little rotation.
- The ledger trail is the recovery weapon. Freezes, PND liens, Mareva injunctions, and clawbacks all worked because the transactions were recorded and attributable — a recurring theme in this blog’s fintech series.
How we can do better
- Cumulative velocity, not single-transaction limits. Monitor rolling exposure per API key, per merchant, per beneficiary cluster, and per bank: count-to-value ratios, day-over-day deltas, and aggregated outflow across all accounts an attacker could reach. Flutterwave’s ₦2.9B in 63 transactions is exactly the signature cumulative thresholds catch.
- Treat API credentials like the crown jewels. Scope keys to the minimum, rotate on a schedule, bind high-value keys to IP allowlists or mTLS, and alert on behavioral drift (a merchant key moving money in a pattern it never has before).
- Build beneficiary graph detection. Cluster recipients by shared signals — same device, same timing, same session, same bank branch. A “new beneficiary, funded within minutes, cluster of 100+” alert catches mule networks before the PND stage.
- Red-team your own thresholds. If attackers read your limits, so should you: simulate transfers that sit just under each trigger and verify something else (anomaly scoring, velocity, graph signals) still fires. The detection that caught the April 2024 incident was behavioral, not threshold-based — that is the model.
- Practice the freeze playbook before you need it. Flutterwave’s response — police petition within days, court orders, PND across 27 banks — worked because the process existed. Run tabletop exercises that end in “who signs the freeze request, and how fast.”
- Use KYC linkage for attribution. BVN/NIN linkage turned anonymous mule accounts into recoverable assets. Kenya’s equivalent (ID-linked mobile money, KYC/AML analytics pipelines) is the same lever.
- Share threat intel across banks. The 27 banks in one freeze order all saw fragments of the same attack. A shared fraud-signal exchange — like the one Kenya’s banking sector is building post-NCBA — turns fragments into a picture.
Key takeaways
| Lesson | Action |
|---|---|
| Attackers fragment funds across accounts and banks | Monitor cumulative velocity across the whole ecosystem, not per-account |
| Static limits become a blueprint for evasion | Layer behavioral/anomaly detection over thresholds |
| Merchant keys are a prime target | Scope, rotate, and bind credentials; alert on drift |
| The ledger trail enables recovery | Preserve audit trails and practice the freeze/clawback playbook |
| Attribution needs identity | Link accounts to KYC/BVN/ID and share mule signals across banks |
The Flutterwave story is not a cautionary tale about one Nigerian company — it is a field guide to how payment hubs are attacked and what controls actually catch the attack. As African fintechs scale settlement volumes, the question is not whether they will be probed; it is whether their monitoring looks across accounts, banks, and thresholds the way the attackers do.
References
- Alleged security breach leaves millions of dollars missing from Flutterwave accounts – TechCrunch
- Exclusive: Flutterwave loses ₦11 billion in security breach – TechCabal
- Customers report frozen accounts over illegal transfers from Flutterwave – TechCabal
- Hackers steal ₦2.9 billion from Flutterwave accounts – Techpoint Africa
- Flutterwave hit by ₦11 billion cybersecurity breach – Techloy
- Kenyan government withdraws fraud allegations against Flutterwave – Techpoint Africa
- Kenyan court freezes Flutterwave’s bank accounts – TechCabal