Since last Friday October 30, 2026, Lendsqr has been battling a wave of cyberattacks. Let me say the most important part first: we are safe. We have not lost money, we have not lost data, and no customer account has been compromised.
But we are not safe because they forgot about us. We are safe because the things we built over the years have held up, and because we caught them early.
We were lucky to be in the room when it started.
The first wave hit on Friday while we were in the middle of a conversation about going live with a customer, so we watched it happen in real time. The second came on Sunday night, November 2, 2026, and we only caught it because one of our security guys happened to be awake. That is luck, and I won’t pretend otherwise. But it taught us something that the defenses you already have will hold them back for a while, but they will keep trying other doors until one open. Knowing the moment, they start is what buys you the time to shut those doors first.
We were already on the offensive.
When a few fintechs got hit around October 1 to 3, we didn’t wait to be next. We turned on ourselves and ran a full internal security review of our own code and systems, the way an attacker with the blueprints would. I honestly thought we were in good shape. We found over 800 issues, from small to serious, and we spent the next three weeks fixing them like our lives depended on them.
Three weeks before this wave reached us. If we hadn’t, I would be writing a very different post today.
This is happening to everybody in Nigeria, and nobody is talking.
Since early October, this wave has been going through the technology world. On October 29, Binance lost about $6.3 billion after one engineer’s laptop was compromised. A week earlier, Railway, a cloud platform used by thousands of developers, told every one of its customers to change all their secret keys. Hundreds of developer accounts on GitHub have been taken over with stolen access tokens and used to steal even more.
Abroad, when this happens, companies come out and say it, and the next company learns from it. In Nigeria, we keep quiet. We fix it behind closed doors and pray the story never leaks. Then the same people walk into the next company with exactly the same trick, because nobody heard what happened to the first one. I know we are not the first company the GitHub trick was tried on. If whoever went before us had spoken up, think of how much of this we could have stopped before it started. Many of the fixes we applied between the weekend and today would have been in place weeks ago.
Every single company whose people have spoken to me in confidence over the last few days has either been breached or lost money. Not one of them has said a word in public. So I decided that somebody has to break this thing. Maybe I can afford to speak because it hasn’t hurt us. I just hope I don’t get compromised while I’m still typing this, because they are escalating by the hour.
They are fucking persistent.
The way in is almost always a developer. They steal the tokens developers use for GitHub, from infected laptops or old leaks, and use them to plant code that silently copies out every secret a company keeps in its pipelines. Some now pose as recruiters. If you are a developer going for interviews and someone sends you a “test project” to run, be very careful, because with some of these projects, simply opening the folder in VS Code is enough to compromise your machine. That is reportedly how Binance started. Somebody downloaded the wrong code.
At our own doors, they rented cheap servers, mostly in Asia, and threw them away the moment we blocked one. They scanned every public page and login screen they could find, tried to guess the passwords of staff, including staff at the lenders who use our platform, sent fake payment notifications to see what would swallow them, and in one case came in with a borrower’s correct password, stolen from somewhere else, only for our device checks to stop them cold.
This is our playbook.
The week before this started, as soon as we heard what was happening in the market, I called an all-hands meeting. You either showed up or you went home. Everybody showed up. Some of my Gen Z colleagues thought I was exaggerating when I told them I did not want to end up at the EFCC because a customer got compromised on our watch. I won’t end up at the EFCC, but the point stands: people trust us with their businesses and their livelihoods, and that is not something you play with. We have kept the whole team updated ever since.
We wrote to every developer who has worked with us in the last 6 years, asking them to revoke their tokens and clean their machines, because if somebody had warned us early, we would have been spared a lot of this, and we wanted to give them that chance. We wrote to our customers too, before anything could go wrong, which most companies here never do even after something has.
Every time we find an attacker’s address, we report it to the company hosting it and to everybody along the chain. Most of what we know about how these people work, we know because somebody else talked about it on the internet. Evil thrives in darkness, and we would rather drag it into the light.
Nobody is sleeping and I have bags under my eyes. We are blocking every network the attacks come from, and we have shut most of Asia out of our services while leaving room for the places our customers actually are. Cloudflare is blocking a lot of the noise automatically. When we kill one batch, we sit down and ask ourselves how they will come back, and then we attack ourselves first. We use Hinoki Security for this, and I strongly recommend it. Hinoki is a cybersecurity company built on one idea, putting attacker-grade tools in the hands of defenders, and it probes your systems the way a black-hat hacker would, starting from your DNS records and working inwards. We learned a lot about how these people think just by watching it work.
AI has been unbelievable through all of this. Pulling logs together and seeing the full picture across Cloudflare and our own systems takes very smart engineers three or four hours. We are doing it in ten minutes. Dario of Anthropic is insufferable and I totally dislike him. But his Claude Opus 5.5? Fucking awesome. And if you’re dealing with an attack, don’t bother with the Fable models. Their tripwires kick in and they won’t do anything useful for you. I also want to give a big shout-out to Muyiwa Olufon, founder of Technology and X, former Global CISO at Flutterwave and Head of Information Security for Nike International, and a real fighter for the Nigerian tech ecosystem, who helped us when we needed it. If you need someone to help you jam the door shut, reach out to him.
Blocking this hard has a cost. Over the next week or so, some of our customers may notice the odd glitch, or a customer who is travelling may struggle to reach an app. That is a price I am willing to pay, and we will fix anything that breaks the moment we hear about it.
If you are a developer, do this today.
Go into your GitHub right now and revoke every token you have ever created, then make new ones. Scan your machine before anything else. Don’t run code or open projects from people you don’t know, no matter how juicy the job sounds.
If you run a company, do this today.
Turn on two-factor authentication on email, cloud, code and every console that touches money. Remove everyone who has left. Change your API keys and passwords, especially the ones that have ever sat in a chat or a shared document. And when somebody asks you to change where money goes, pick up the phone.
If these addresses have visited you, look closely.
The first wave, between October 30 and November 2, used stolen developer tokens against code repositories from these addresses:
- 66.55.76.127 (Kamatera, Los Angeles)
- 166.88.8.133 (Evoxt, New York)
- 95.135.181.151 (a leased range routed through Virtuo)
- The second wave, between November 2 and 3, came at our platforms directly:
- 103.151.172.0/23 (Hong Kong, network AS134972)
- 141.11.146.78 (Hong Kong, AS134972)
- 43.243.192.91 (Hong Kong, AS134972)
- 103.42.183.18 (Hong Kong, AS62468)
- 223.91.198.216 (China Mobile)
- 18.182.61.18 (Amazon, Tokyo)
- 142.249.39.80 (Back Waves, AS153371)
- 38.91.101.149 (GTHost, New York)
They mostly used the command-line tool curl (versions 8.22.0 and 8.20.0), cycled through staff logins every few seconds, flooded password resets, and tried to reach the cloud metadata address 169.254.169.254 through public pages. If any of these show up in your logs, assume someone was testing you, block them, and check what they touched.
None of this is new. That is the point. They are winning because we are quiet, and because we keep leaving the same doors open. Being aware is the fastest way to stop them.
Speak up. Fraud thrives in darkness.
Discover more from Adedeji Olowe
Subscribe to get the latest posts sent to your email.
