Attacker didn't hack anything... they just POSTed this to the endpoint
{
"event": "transfer.success",
"amount": 500000,
"status": "success"
}
backend credited the user. zero money moved lol. The backend trusted the request blindly
It credited user balances without verifying the payment
Programming
A Nigerian fintech just lost ₦20M to a fake webhook
Started by WheresWaladeen · Apr 30, 2026
20 Million Nigerian Dollars is a whole $13000 USD. Still his royal highness Akmal will be able to impress many a royal bride to be of not so noble birth with that.
I have been looking for someone with such knowledge to work with