- Beneficiaries of the ₦2.9 billion ($6.3 million) Flutterwave breach reported in March have confirmed they were detained by the police.
- Beneficiaries of another set of ₦250 million($543,088) and ₦200 million ($434,470) transactions were also reportedly detained by the Police.
- Flutterwave insists that there was no breach.
On March 5, 2023, Techpoint Africa got access to court documents that revealed African fintech unicorn, Flutterwave, was requesting a court order to freeze accounts that were beneficiaries of the ₦2.9 billion ($6.3 million).
Flutterwave filed a motion to freeze 170 accounts across 27 commercial banks in Nigeria. The motion was granted by the Magistrate Court of Lagos (Yaba Magisterial District sitting at Yaba).
The primary beneficiary of the monies, *Damilola Williams, said he received ₦1.6 billion ($3.4 million) from William Atong Chen, for the sale of USDT.
In a bid to get his accounts unfrozen and clear his name, Williams willingly went to the Police State Criminal Intelligence Department, Panti, Yaba, Lagos (the police station Flutterwave reported the illegal transfer of funds on February 19, 2023) on Wednesday, March 29, 2023.
However, Williams along with four others — first beneficiaries and second beneficiaries — were detained by the police until Friday, March 31, 2023, when they were let go on bail.
According to Williams, "Nigeria police and EFCC detained beneficiaries on Flutterwave's behalf."
New ₦450 million ($677,559) breach?
Some sources claim that Flutterwave has been breached multiple times since the first one was reported on March 5, 2023. While the details of this new breach aren't clear, beneficiaries and other sources, claim that there was a ₦200 million ($434,470) and ₦250 million ($543,088) sale of cryptocurrency to a Chinese merchant.
A fourth beneficiary, *Samuel Johnson, who received payment for crypto assets from Williams said, "since the first court petition went viral, they (Flutterwave and banks) stopped going to court even after they (Flutterwave) were breached multiple times. All they do is set EFCC on merchants, and banks lock the accounts without a court order, just a mail from Flutterwave through the Nigeria Inter-Bank Settlement System Plc (NIBSS)."
He also shared evidence of new large transactions where the receiving parties were paid directly from Flutterwave. One of those receiving parties is crypto trader, *Abiodun Ajayi, a crypto trader.
Ajayi's story is similar to Williams'. He sold USDT to a Chinese customer for naira, and like Williams, he has been in business with this customer for years.
He told Techpoint Africa that the transaction started on March 21 and ended on March 22, 2023. He said the total amount of USDT sold was around ₦200 million.
However, by March 22, 2023, his account was frozen.
According to Ajayi, he had no idea why his account was frozen, and his bank didn't tell him either.
"I actually didn't know, but I know that Flutterwave went to the police to report that accounts should be frozen. The court order also states that people who received money from their (Flutterwave) accounts conspired with the hackers who hacked their accounts, which made police detain people who received funds from their accounts."
Just like Williams, Ajayi also went to the police at Panti, Yaba on March 30, 2023, to set the record straight but he was also detained and had to pay ₦200,000 to get bail.
According to him, he went to Lagos to attend a meeting between Flutterwave, banks and the police since his account was also frozen as a result of a Flutterwave transfer.
Neither Flutterwave nor the banks of the beneficiaries showed up for the meeting.
Willaims told Techpoint Africa that there was another ₦250 million transaction in which the beneficiary, identified as *Ayobami, is currently being detained by the EFCC as of press time.
The Chinese connection
In all the transactions that has led to Flutterwave freezing bank accounts, there has been the involvement of a Chinese person.
Ajayi and Williams said they sold crypto to a Chinese person who paid them directly from Flutterwave.
Williams said he was introduced to the Chinese individual, whom he identifies as William Atong Chen, by a fellow crypto trader, Ehije Igberaese Joshua who has been trading with them since 2019.
When Williams contacted Chen that his account was frozen because of, their transaction, Chen maintained that the funds were transferred legally.
This was not the first time Chen had transferred funds from a Flutterwave account.
Interestingly, when Alex Onyia, founder of school management software platform Educare, which facilitates payments through Flutterwave, tweeted that Flutterwave was hacked, he said it was done by Omar Edewor Trades.
Edewor Trades is the beneficiary of ₦8.3 million ($17,868) illegally transferred from his client account.
In response to Onyia, a Twitter user - in a now-deleted tweet — shared a letter, which read that he (the Twitter user) transferred ₦220,000,000 ($473,627) from his Flutterwave account to PISI Market Services and Omar Edewor Trades.
Although the recipient was not revealed, the letter is a request that Omar Edewor Trades should not be held "responsible or liable in any way for the source of funds I used to pay them. They were simply a recipient of a lawful transaction that I performed."
The same Omar Edewor was named as the beneficiary of the ₦8.3 million ($17,868) illegally transferred from the account of Onyia's clients.
While Omar Edewor might not seem like a Chinese name, the phone number on the letter is a Shangai phone number.
Flutterwave users report wrongful debits
While Onyia got his client's ₦8.5 million back on March 10, 2023, some Flutterwave users who had funds removed from their accounts without authorisation are yet to be reimbursed.
A Flutterwave user, Nwankwo Ifeanyi David, said ₦321,000 ($690) left his account on July 26, 2022, and nothing has been done about it since.
"I was on the app to do a transfer when I saw that ₦321,000 had been debited."
David got in touch with Flutterwave to get the issue resolved but according to him the company "kept saying they would resolve it but didn't."
Several months after nothing was done about the illegal transfer of funds from his accounts, David resolved to leave the issue alone.
Another user, Muili Seun, also told Techpoint Africa that funds went missing from his account in February 2023.
In an attempt to recover the funds, Seun reached out to Flutterwave, but the company said it was unable to "recoup the funds as they'd been utilised by the beneficiary."
Similarly, another Flutterwave user, Philip, is yet to get a refund of the ₦20,000 ($43) that left his account in September 2022.
According to Philip, the illegal debit was done via API, as he had two-factor authentication enabled.
Per the screenshot Philip shared with Techpoint Africa, the transfer was made to a United Bank for Africa user.
Like Seun and David, he has not gotten his money back. When he reached out to Flutterwave, he was told to get a court order to have it returned.
Flutterwave insists all is well
While email screenshots show that bank accounts were frozen by order from Flutterwave, the company maintains that there was no breach
"As previously addressed in our public statement, the Flutterwave systems have not been hacked," a company representative said in an email to Techpoint Africa, "Earlier this year during a routine check of our transaction monitoring system, we identified an unusual trend on some users’ profiles. In line with our standard operating procedure, we immediately launched a review which revealed that some users who had not activated some of our recommended security settings might have been susceptible. As far as our investigation has shown, this is the extent of the matter. We are not aware of any ‘hacks’, as your sources have claimed."
According to TechCabal, Ajeka Iliasu Opaluwa, a first beneficiary of the first breach believes Flutterwave could be pursuing a forfeiture.
Flutterwave neither confirmed nor denied this claim
"With regards to the forfeiture petition, we cannot disclose specific legal actions or discuss ongoing cases due to the confidential and sensitive nature of these matters. However, we are collaborating with the appropriate authorities and pursuing all available legal options to hold those responsible accountable."
From the court documents to frozen accounts, it can be deduced that there is a legal scuffle between Flutterwave and these beneficiaries. More clarity can only be gained as the story unfolds.
**-Not real name.