PYMSTR vs Alphapo.
$60M hacked by Lazarus Group. Enterprise-only. Still custodial.
What happened to Alphapo?
In July 2023, the Lazarus Group drained roughly $60 million from Alphapo's custodial hot wallets across multiple chains. The funds were client money: Alphapo was a custodial processor, which means it held merchant balances in its own wallets, and that pool is exactly what the attackers took.
The business never fully recovered. The iGaming market it served now treats Alphapo as defunct in practice, in a state of partial wind-down. Even where it still operates, onboarding is enterprise-only with negotiated contracts, so there is no self-serve path for a merchant who needs to start processing now.
Former Alphapo merchants have to pick a new rail, and the hack itself is the buying criteria: if the processor never holds your money, there is no pot to drain. That is what PYMSTR is (the industry calls it non-custodial): payments settle straight to your own wallet, USDC and USDT across 5 chains, 0.5% flat, no KYB, and iGaming is welcome.
The facts
- Hacked
- ~$60M drained by Lazarus Group from custodial hot wallets, July 2023
- Status
- Partial wind-down; treated as defunct in practice by the iGaming market
- Access
- Enterprise-only onboarding, negotiated contracts, no self-serve
- Migration path
- Non-custodial gateway: PYMSTR settles to your wallet, 0.5% flat, 5 chains, no KYB
Migrating off Alphapo
Alphapo has been in partial wind-down since the July 2023 Lazarus Group hack. Enterprise-only onboarding means there is no self-serve exit path, and former merchants have moved to non-custodial rails. Here is what the switch looks like in practice.
Freeze new Alphapo volume
Stop routing new customer traffic to your Alphapo checkout. Funds still sitting on the platform continue to settle on Alphapo's own schedule (custodial: they hold your money), and there is no way to accelerate a wind-down operator's payout from the merchant side.
Set up a non-custodial destination wallet
PYMSTR uses your own wallet as the settlement address. The industry calls this non-custodial: money moves straight from the customer to your own wallet, no third-party balance sitting in between. Social login (Google, Email, SMS, Apple) creates an embedded wallet in about 5 minutes. No KYB, no contracts, no setup fee.
Pick which stablecoins and networks to accept
PYMSTR supports USDC on Ethereum, Base, Polygon and Arbitrum; USDT on Ethereum, Polygon, Arbitrum and BNB. Enforced payments mean customers can only pay on chains you approve, so wrong-network mistakes are architecturally impossible.
Point customer traffic at PYMSTR
Three integration paths: payment links (about 1 minute, no code), hosted checkout (about 10 minutes, no code), or the API (about 5 minutes per endpoint, 1 POST). Same customer experience as Alphapo, non-custodial settlement, 0.5% flat instead of Alphapo's enterprise-negotiated rate.
Alphapo review
Alphapo was a custodial crypto payment processor built for large iGaming operators: enterprise-only onboarding, negotiated contracts, and hot-wallet infrastructure that served major gambling platforms. In July 2023 the Lazarus Group drained roughly $60M from those hot wallets across multiple chains, and the business never fully recovered. The iGaming market now treats Alphapo as defunct in practice, in a state of partial wind-down, which makes this less a product review and more an operational-collapse case study.
- Enterprise-scale iGaming historyBefore the 2023 hack, Alphapo processed crypto payments for major gambling platforms and was one of the recognized names in iGaming payment infrastructure. Operators who used it got large-operator features under negotiated enterprise contracts.
- Full-service custodial stack for large operatorsMulti-chain hot-wallet infrastructure, conversion, and settlement services in one vendor. For enterprises that wanted a single negotiated relationship rather than self-serve tooling, the model fit, until the custody risk materialized.
- The $60M Lazarus Group hackIn July 2023, attackers drained roughly $60M from Alphapo hot wallets across multiple blockchains. The stolen funds belonged to the gambling platforms that stored balances with Alphapo, and the root cause is the custodial pooling itself. PYMSTR is non-custodial: funds settle directly to your wallet, so there is no pool to drain.
- Partial wind-down: continuity is the core riskAlphapo never fully recovered from the hack and the iGaming market treats it as defunct in practice. Routing live deposit volume to a processor whose operational future is uncertain is a risk no fee structure can compensate for. PYMSTR cannot strand your funds in a wind-down because it never holds them.
- Enterprise-only gatekeepingNo self-serve signup, no public onboarding, and weeks to months of enterprise sales before processing. Small and mid-size operators were excluded entirely. PYMSTR onboards any merchant in 5 minutes with no KYB and no contracts.
- Opaque custom pricingAlphapo never published rates. Every contract was negotiated, and opacity in payments usually means the smaller party pays more. PYMSTR is 0.5% flat, published on the website, identical for every merchant.
At a glance
- Custody
- Custodial hot wallets across multiple chains; drained for $60M by Lazarus Group, July 2023
- Fees
- Custom enterprise pricing, never published
- Best for
- Historically, large enterprise iGaming operators on negotiated contracts
- Not for
- Anyone choosing a processor in 2026: partial wind-down makes continuity the primary risk
The numbers speak.
| Feature | Alphapo | PYMSTR Recommended |
|---|---|---|
| Who holds your money | Custodial. Hot wallets hacked for $60M | We never do. It's yours instantly |
| Security Track Record | $60M stolen by Lazarus Group (July 2023) | Nothing to hack, no fund storage |
| Transaction Fees | Custom enterprise pricing. Not public | 0.5% flat. Published, no negotiations |
| Onboarding | Enterprise-only. Weeks to months | 5 minutes, no KYB, no contracts |
| Settlement | Custom enterprise settlement | Instant. Direct to your wallet |
| Self-Serve Access | No. Enterprise sales only | Yes. Any merchant, any size |
Why merchants add PYMSTR.
$60M stolen in a single hack
In July 2023, North Korean Lazarus Group hackers drained $60M from Alphapo's hot wallets. Multiple gambling platforms lost access to deposited funds. The same month, CoinsPaid lost $37M. $97M stolen from custodial processors in one month. PYMSTR is non-custodial. Funds go directly to your wallet. There's nothing to hack.
Enterprise-only locks out most operators
Alphapo is enterprise-only with no public pricing, no self-serve option, and opaque onboarding. Small and mid-size operators are excluded entirely. PYMSTR gives every merchant the same enterprise-quality features. Enforced payments, multi-chain support, full analytics, with zero gatekeeping.
Opaque pricing hides the true cost
Alphapo doesn't publish pricing. Everything is negotiated per enterprise account, and opacity often means higher true costs. PYMSTR charges 0.5% flat. Published on the website, no tiers, no negotiations, no hidden fees.
Short answers. No jargon.
Alphapo questions.
Barely, and not in a form most merchants can use. Since the July 2023 hack Alphapo has been in a state of partial wind-down, and the iGaming market it served treats it as defunct in practice. Where anything still runs, access is enterprise-only through negotiated contracts. There is no self-serve signup, so a merchant who needs to start processing today cannot practically onboard.
Add the stablecoin rail to your checkout.
Non-custodial. Stable-in, stable-out. Funds settle directly to your wallet on-chain. Live in minutes, not months.