MAY 2019




"Remitano offers escrowed P2P Bitcoin marketplace for a large number of cryptocurrency users." "Remitano provides [a] marketplace where people buy and sell Bitcoin easily and safely with notable simple UI, friendly online customer support 24/7 and lowest fee compared with major players on the market." According to their site, the Remitano "team is comprised mostly by banking professionals with extensive experience in financial products, E-currencies, Payment System and Agile Software Development, and others." "Remitano makes cryptocurrency accessible to countries such as, but not limited to: Vietnam, Malaysia, Nigeria, India, South Africa, Singapore, Cambodia, Kenya, Ghana, and Pakistan." "The crypto exchange says it serves countries like Nigeria, Vietnam, China, Cambodia, Australia, [and] United State[s,] among others."


"In September 2018, Remitano, a Republic of Seychelles incorporated firm, announced support for XRP. Since then, there has been smooth withdrawals and deposits of the altcoin until the issue of fake XRP deposit surfaced."


"Apparently, a user can exploit the flaw in “Partial Payment” to input the wrong parameters and move off free XRP from exchanges. Bitrue explained that instead of using the “amount” parameter when recording payments, exchanges should use “DeliveredAmount” which is the correct parameter."


"Because often the exchange (especially the new ones supporting $XRP) wasn't aware of the existence of "partial payment"! Thus using the wrong parameter "Amount' to record the payment. The CORRECT parameter to use is and should always be "DeliveredAmount" ‼️"


"The said vulnerability allows a user to fake an XRP deposit transaction and then dump the sent “XRP” tokens on the exchange. In this case, the crooked user faked a deposit of 330,000 XRP, but the actual XRP delivered were just 0.003255 XRP. In effect, BitoPro ended up losing 7 million XRP. Bitrue took the step to expose the flaw and let other exchanges and users know about it to save them from further loses."


"Remitano has paused all XRP deposits and withdrawals to deal with fake XRP deposits. We also halted trading until we blocked all the fake XRP deposits. Please leave your XRP in place, and do not buy and sell until further notice."


"Contacted them and only got vague answers and will be solved in 6 hours." "Remitano has not offered a deep insight on the ongoing security situation on the platform. Doing so will reduce lingering rumour that the cryptocurrency exchange has been hacked."


"The crypto exchange declared that it has paused all XRP deposits and withdrawals to battle the suspected fake XRP deposits."


"Also, it stopped all crypto trade on the platform. The development affects all the digital currencies supported by Remitano: Bitcoin, Ethereum, Litecoin, Ripple’s XRP, Tether USDT, and Bitcoin Cash." "XRP buyers on the exchange suffered a great deal of losses due to Remitano’s sluggish response to the complaints of its users."

The Remitano platform implemented a flawed XRP deposit mechanism in 2018, which allowed users to deposit XRP and get credited for more XRP than actually deposited, by making a "partial payment".


This was exploited by malicious users, and funds were stolen as a result. The Remitano platform doesn't appear to have responded until November.


It appears at present that Remitano is fully operational. Further updates on the matter could not be located.


This type of situation can be prevented through only implementing protocols with a full understanding of how they work. It can be detected by carefully monitoring the balances on the blockchain versus the balances in the database to detect discrepancies.


Ultimately, this type of mistake happens one-time and should be corrected immediately.


Check Our Framework For Safe Secure Exchange Platforms

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.