Remitano False XRP Deposit

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Remitano

The Remitano platform implemented a flawed XRP deposit mechanism in 2018, which allowed users to deposit XRP and get credited for more XRP than actually deposited, by making a "partial payment".

This was exploited by malicious users, and funds were stolen as a result. The Remitano platform doesn't appear to have responded until November.

It appears at present that Remitano is fully operational. Further updates on the matter could not be located.

This exchange or platform is based in Seychelles, or the incident targeted people primarily in Seychelles.

About Remitano

"Remitano offers escrowed P2P Bitcoin marketplace for a large number of cryptocurrency users." "Remitano provides [a] marketplace where people buy and sell Bitcoin easily and safely with notable simple UI, friendly online customer support 24/7 and lowest fee compared with major players on the market." According to their site, the Remitano "team is comprised mostly by banking professionals with extensive experience in financial products, E-currencies, Payment System and Agile Software Development, and others." "Remitano makes cryptocurrency accessible to countries such as, but not limited to: Vietnam, Malaysia, Nigeria, India, South Africa, Singapore, Cambodia, Kenya, Ghana, and Pakistan." "The crypto exchange says it serves countries like Nigeria, Vietnam, China, Cambodia, Australia, [and] United State[s,] among others."

"In September 2018, Remitano, a Republic of Seychelles incorporated firm, announced support for XRP. Since then, there has been smooth withdrawals and deposits of the altcoin until the issue of fake XRP deposit surfaced."

"Apparently, a user can exploit the flaw in “Partial Payment” to input the wrong parameters and move off free XRP from exchanges. Bitrue explained that instead of using the “amount” parameter when recording payments, exchanges should use “DeliveredAmount” which is the correct parameter."

"Because often the exchange (especially the new ones supporting $XRP) wasn't aware of the existence of "partial payment"! Thus using the wrong parameter "Amount' to record the payment. The CORRECT parameter to use is and should always be "DeliveredAmount" ‼️"

"The said vulnerability allows a user to fake an XRP deposit transaction and then dump the sent “XRP” tokens on the exchange. In this case, the crooked user faked a deposit of 330,000 XRP, but the actual XRP delivered were just 0.003255 XRP. In effect, BitoPro ended up losing 7 million XRP. Bitrue took the step to expose the flaw and let other exchanges and users know about it to save them from further loses."

"Remitano has paused all XRP deposits and withdrawals to deal with fake XRP deposits. We also halted trading until we blocked all the fake XRP deposits. Please leave your XRP in place, and do not buy and sell until further notice."

"Contacted them and only got vague answers and will be solved in 6 hours." "Remitano has not offered a deep insight on the ongoing security situation on the platform. Doing so will reduce lingering rumour that the cryptocurrency exchange has been hacked."

"The crypto exchange declared that it has paused all XRP deposits and withdrawals to battle the suspected fake XRP deposits."

"Also, it stopped all crypto trade on the platform. The development affects all the digital currencies supported by Remitano: Bitcoin, Ethereum, Litecoin, Ripple’s XRP, Tether USDT, and Bitcoin Cash." "XRP buyers on the exchange suffered a great deal of losses due to Remitano’s sluggish response to the complaints of its users."

This exchange or platform is based in Seychelles, or the incident targeted people primarily in Seychelles.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Remitano False XRP Deposit
Date	Event	Description
May 29th, 2019 12:00:00 AM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

This type of situation can be prevented through only implementing protocols with a full understanding of how they work. It can be detected by carefully monitoring the balances on the blockchain versus the balances in the database to detect discrepancies.

Ultimately, this type of mistake happens one-time and should be corrected immediately.