vs Alphapohead-to-head

PYMSTR vs Alphapo.

$60M hacked by Lazarus Group. Enterprise-only. Still custodial.

//Alphapo reviewindependent assessment

Alphapo was a custodial crypto payment processor built for large iGaming operators: enterprise-only onboarding, negotiated contracts, and hot-wallet infrastructure that served major gambling platforms. In July 2023 the Lazarus Group drained roughly $60M from those hot wallets across multiple chains, and the business never fully recovered. The iGaming market now treats Alphapo as defunct in practice, in a state of partial wind-down, which makes this less a product review and more an operational-collapse case study.

+ Pros

Enterprise-scale iGaming history

Before the 2023 hack, Alphapo processed crypto payments for major gambling platforms and was one of the recognized names in iGaming payment infrastructure. Operators who used it got large-operator features under negotiated enterprise contracts.

Full-service custodial stack for large operators

Multi-chain hot-wallet infrastructure, conversion, and settlement services in one vendor. For enterprises that wanted a single negotiated relationship rather than self-serve tooling, the model fit, until the custody risk materialized.

− Cons

The $60M Lazarus Group hack

In July 2023, attackers drained roughly $60M from Alphapo hot wallets across multiple blockchains. The stolen funds belonged to the gambling platforms that stored balances with Alphapo, and the root cause is the custodial pooling itself. PYMSTR is non-custodial: funds settle directly to your wallet, so there is no pool to drain.

Partial wind-down: continuity is the core risk

Alphapo never fully recovered from the hack and the iGaming market treats it as defunct in practice. Routing live deposit volume to a processor whose operational future is uncertain is a risk no fee structure can compensate for. PYMSTR cannot strand your funds in a wind-down because it never holds them.

Enterprise-only gatekeeping

No self-serve signup, no public onboarding, and weeks to months of enterprise sales before processing. Small and mid-size operators were excluded entirely. PYMSTR onboards any merchant in 5 minutes with no KYB and no contracts.

Opaque custom pricing

Alphapo never published rates. Every contract was negotiated, and opacity in payments usually means the smaller party pays more. PYMSTR is 1% flat, published on the website, identical for every merchant.

// at a glance

CustodyCustodial hot wallets across multiple chains; drained for $60M by Lazarus Group, July 2023

FeesCustom enterprise pricing, never published

Best forHistorically, large enterprise iGaming operators on negotiated contracts

Not forAnyone choosing a processor in 2026: partial wind-down makes continuity the primary risk

//The numbers6 dimensions

The numbers speak.

Feature	Alphapo	PYMSTR Recommended
Who holds your money	Custodial. Hot wallets hacked for $60M	We never do. It's yours instantly
Security Track Record	$60M stolen by Lazarus Group (July 2023)	Nothing to hack, no fund storage
Transaction Fees	Custom enterprise pricing. Not public	1% flat. Published, no negotiations
Onboarding	Enterprise-only. Weeks to months	5 minutes, no KYB, no contracts
Settlement	Custom enterprise settlement	Instant. Direct to your wallet
Self-Serve Access	No. Enterprise sales only	Yes. Any merchant, any size

Who holds your money

PYMSTR

We never do. It's yours instantly

Alphapo

Custodial. Hot wallets hacked for $60M

Security Track Record

PYMSTR

Nothing to hack, no fund storage

Alphapo

$60M stolen by Lazarus Group (July 2023)

Transaction Fees

PYMSTR

1% flat. Published, no negotiations

Alphapo

Custom enterprise pricing. Not public

Onboarding

PYMSTR

5 minutes, no KYB, no contracts

Alphapo

Enterprise-only. Weeks to months

Settlement

PYMSTR

Instant. Direct to your wallet

Alphapo

Custom enterprise settlement

Self-Serve Access

PYMSTR

Yes. Any merchant, any size

Alphapo

No. Enterprise sales only

//Why operators add PYMSTR3 reasons

Why merchants add PYMSTR.

$60M stolen in a single hack

In July 2023, North Korean Lazarus Group hackers drained $60M from Alphapo's hot wallets. Multiple gambling platforms lost access to deposited funds. The same month, CoinsPaid lost $37M. $97M stolen from custodial processors in one month. PYMSTR is non-custodial. Funds go directly to your wallet. There's nothing to hack.

Enterprise-only locks out most operators

Alphapo is enterprise-only with no public pricing, no self-serve option, and opaque onboarding. Small and mid-size operators are excluded entirely. PYMSTR gives every merchant the same enterprise-quality features. Enforced payments, multi-chain support, full analytics, with zero gatekeeping.

Opaque pricing hides the true cost

Alphapo doesn't publish pricing. Everything is negotiated per enterprise account, and opacity often means higher true costs. PYMSTR charges 1% flat. Published on the website, no tiers, no negotiations, no hidden fees.

//Alphapo questions5 answers

Short
answers.
No jargon.

In July 2023, the Lazarus Group compromised Alphapo's hot wallets across multiple blockchains, stealing approximately $60M. Multiple gambling platforms that stored funds with Alphapo were directly affected. This was only possible because Alphapo is custodial. PYMSTR is non-custodial. We never hold merchant funds.

Yes. PYMSTR serves merchants of any size. From startups to enterprises, with the same 5-minute onboarding, 1% flat fee, and full feature set. No enterprise sales process, no minimum volume requirements.

Enforced payments mean the merchant controls exactly which blockchains and stablecoins customers can use. PYMSTR's mandatory sign-in creates an embedded wallet so customers can only pay with approved options. Wrong-chain and wrong-token errors are impossible. Alphapo has no equivalent feature.

Yes. Unlike Alphapo's enterprise-only model, PYMSTR serves any operator regardless of size. The same $0 setup, 1% flat fee, and full feature set is available to everyone, no enterprise sales process required.

Alphapo and CoinsPaid are both custodial crypto payment processors with confirmed hack histories. Alphapo lost $60M to the Lazarus Group in July 2023. CoinsPaid lost $44.5M across two incidents in 2023 and 2024. Custody is the common failure mode: both held merchant funds on their own servers, which is what made the attacks possible. PYMSTR is non-custodial, so funds never touch our servers. The dedicated CoinsPaid comparison is available at /vs/coinspaid.

More comparisons