South African bank facing $60m in losses after master key stolen

Amid surging African interest in cryptocurrency, a state-owned bank learns a painful lesson about centralization.

South Africa’s Postbank, the banking subsidiary of the state-owned South African Post Office, reportedly lost more than $3.2 million to fraudulent charges after suspected employees stole the bank’s master key.

As a result, the bank will replace more than 12 million customer cards. According to the Sunday Times of South Africa (via ZDNet), employees printed the code from an old data center in December 2018.

From March to December 2019, the master key was used to make more than 25,000 transactions, gradually siphoning 56 million rand ($3.26 million) from customers’ accounts.

Ultimately, the process of replacing customer cards—including both banking cards and government benefits cards—will cost Postbank more in the long run. The Sunday Times reports that the bank will spend more than 1 billion rand ($58 million) to address the breach.

The unnamed researcher behind the @Bank_Security Twitter account told ZDNet that bank codes are usually split across various managers and executives to avoid such security breaches, and that banks often also change the key and the people holding it.

In this case, it appears that a single point of failure created a major and costly problem for Postbank.

Crypto keeps surging

The Postbank report comes during a time in which interest in which blockchain-based cryptocurrencies—which are designed to eliminate single points of failure—is surging across Africa, as highlighted in a recent Amazon Prime documentary.

In May, Bitcoin trading in Africa broke a volume record less than two weeks after setting the previous all-time high. And according to a map published by Blockchain Center (via AtoZ Markets) this week, Bitcoin searches on Google are still soaring in Africa, particularly in Kenya.

Twitter and Square CEO Jack Dorsey—a prominent Bitcoin enthusiast—has especially taken a shine to the continent and its crypto potential.

Following an African trip in November 2019, Dorsey tweeted, “Africa will define the future (especially the bitcoin one!),” and announced plans to live in the country for several months in 2020. However, the COVID-19 pandemic halted his plans.