Crypto Payment Processor Hacks: 2024-2025

Between 2023 and 2025, custodial crypto payment processors and exchanges lost over $1.8 billion to hackers. Every major incident shared the same root cause: the processor held customer and merchant funds in centralized wallets. Here's the complete timeline.

Bybit — $1.46 Billion (February 2025)

The largest crypto hack in history. North Korean Lazarus Group hackers compromised Bybit's hot wallet infrastructure, draining $1.46 billion in a single attack. The hack exploited the fundamental weakness of custodial architecture — all customer funds stored in centralized wallets controlled by the platform.

DMM Bitcoin — $308 Million (May 2024)

Japanese exchange DMM Bitcoin lost 4,502.9 BTC ($308 million) when attackers compromised their hot wallet system. Despite security measures including multi-signature wallets, the custodial model meant funds were concentrated and targetable.

CoinsPaid — $44.5 Million (2023-2024)

CoinsPaid, one of the largest crypto payment processors for iGaming, was hacked twice. In July 2023, Lazarus Group stole $37 million through a social engineering attack on an employee. Six months later, in January 2024, hackers returned for another $7.5 million. Multiple gambling platforms using CoinsPaid lost access to deposited funds.

Alphapo — $60 Million (July 2023)

Enterprise crypto payment processor Alphapo lost $60 million in the same month as CoinsPaid — also attributed to Lazarus Group. Hot wallets across multiple blockchains were drained. Several major gambling platforms that processed through Alphapo were directly affected.

The Pattern

Every hack follows the same pattern: a custodial processor pools merchant and customer funds in centralized wallets. Hackers target those wallets — through social engineering, infrastructure compromise, or insider access. When they succeed, everyone who stored funds on the platform loses.

The Non-Custodial Alternative

Non-custodial payment processors eliminate this attack vector entirely. When funds flow directly from customer to merchant wallet on-chain, there is no pool of funds to steal. Even if the processor's infrastructure is fully compromised, merchant funds are safe — because they're in the merchant's own wallet.

PYMSTR is non-custodial. We never hold merchant funds. Payments settle directly to your wallet in 2-15 seconds across 5 chains. The architecture that led to $1.8 billion in losses simply doesn't apply.