What happened to CoinsPaid?
CoinsPaid was hit twice. In July 2023 the Lazarus Group drained roughly $37 million from CoinsPaid's pooled hot wallets. In January 2024 attackers took another $7.5 million from the same infrastructure. Both incidents exploited the custodial architecture: CoinsPaid holds merchant funds on their platform before settling, so a compromise of their systems is a compromise of every merchant balance sitting on it. $44.5 million lost across the two events.
CoinsPaid is still operating and remains one of the largest custodial crypto processors serving iGaming. That is the story: the platform absorbed the losses and kept running, but the January 2024 hit demonstrated the July 2023 hack was not a one-off. Anyone routing merchant funds through CoinsPaid today is trusting the same pooled-hot-wallet model that has now been breached twice.
Merchants evaluating CoinsPaid should look at two things: custody model (custodial: they hold your money before releasing it to you) and fee stack (0.5 to 1.5% headline plus conversion spread plus fiat withdrawal fees, roughly 2 to 3.5% all-in). A non-custodial gateway removes both. That is what PYMSTR is, the industry calls this non-custodial: money moves straight from the customer to your own wallet, no third-party balance sitting in between. 0.5% flat, no KYB, USDC and USDT on 5 networks.
The facts
- Hacked
- $44.5M total: $37M drained by the Lazarus Group in July 2023, then $7.5M in January 2024. Both hits on the pooled custodial hot wallets.
- Status
- Still operating. Largest custodial crypto processor in iGaming. Unresolved custody risk after two consecutive hacks.
- Custody model
- Pooled custodial hot wallets (95% cold / 5% hot per their own disclosures). Merchant funds sit on CoinsPaid infrastructure until manual settlement.
- Migration path
- Non-custodial gateway. PYMSTR settles direct to your wallet, 0.5% flat, no KYB, USDC and USDT across 5 networks.
CoinsPaid vs Alphapo: the two custodial iGaming processors, side by side
CoinsPaid and Alphapo were the default crypto processors for iGaming, and both were drained in the same month. The Lazarus Group took about $37 million from CoinsPaid and about $60 million from Alphapo in July 2023: $97 million out of custodial hot wallets in one month. CoinsPaid was hit again for $7.5 million in January 2024. The difference in 2026 is continuity: CoinsPaid is still operating, Alphapo is in partial wind-down and treated as defunct by the market.
The comparison most operators actually need is not which of the two custodians to pick. It is whether to keep a custodian at all (custodial: they hold your money before it reaches you). PYMSTR never holds your money. The industry calls this non-custodial: the payment settles from the customer straight to your own wallet, so there is no pooled balance for the next hack to drain. The table puts all three next to each other.
| Processor | Status in 2026 | Hacked | Who holds your money | All-in fee | Onboarding | iGaming |
|---|---|---|---|---|---|---|
| CoinsPaid | Still operating | $44.5M: $37M July 2023 + $7.5M January 2024 (Lazarus Group) | Custodial (they hold your money): pooled hot wallets | 0.5-1.5% headline, 2-3.5% all-in | KYB, days to weeks | Yes |
| Alphapo | Partial wind-down, treated as defunct | ~$60M, July 2023 (Lazarus Group) | Custodial (they hold your money): hot wallets across chains | Enterprise pricing, never published | Enterprise-only, weeks to months, no self-serve | Yes, historically |
| PYMSTR | Live, self-serve | Nothing to drain: we never hold your money | Non-custodial: settles straight to your wallet | 0.5% flat | No KYB, about 5 minutes | Welcome |
CoinsPaid review
CoinsPaid is the biggest name in iGaming crypto payments: a full-service custodial gateway with an OTC desk, business wallet, and an established operator client base. The catch is the architecture. CoinsPaid holds merchant funds in pooled custodial wallets, was hacked for $37M in July 2023 (Lazarus Group) and another $7.5M in January 2024, and its 0.5-1.5% headline rate roughly doubles once conversion spreads, withdrawal fees, and inactivity charges are counted.
- Established iGaming track recordCoinsPaid has processed for iGaming operators for years and supports gambling explicitly, which most card-first crypto processors (BitPay, Coinbase) do not. For operators who want a custodial full-service provider, it is the incumbent choice.
- Full-service product suiteOTC desk, business wallet, merchant dashboard, and multi-token acceptance with built-in conversion. Operators who want one custodial vendor for acceptance, conversion, and treasury get all of it in one contract.
- Competitive headline rates at volumeThe 0.5-1.5% volume-based transaction rate undercuts card-rail alternatives for high-risk verticals, and multi-token support widens what customers can pay with, at the cost of conversion spreads on every non-stablecoin leg.
- Hacked twice: $44.5M in losses$37M stolen in July 2023 by the Lazarus Group via social engineering, then another $7.5M in January 2024. The stolen funds were customer deposits sitting in CoinsPaid custody, and the root cause is the custodial pooling itself. PYMSTR is non-custodial: funds settle directly to your wallet, so there is no pool to drain.
- Hidden fees roughly double the headline rateThe 0.5-1.5% rate becomes roughly 2-3.5% all-in after the 0.3-0.8% conversion spread, 1-3% fiat withdrawal fees, and a $25/month inactivity fee after 90 days of dormancy. PYMSTR charges 0.5% flat with no spreads, no withdrawal fees, and no monthly charges.
- KYB onboarding takes days to weeksAs a custodian of merchant funds, CoinsPaid must underwrite each merchant: KYB documentation, contracts, and compliance review before the first payment. PYMSTR onboarding is 5 minutes with no KYB, because the non-custodial architecture removes the underwriting requirement.
- The custodian controls your off-rampWithdrawals route through CoinsPaid. They can be delayed, require additional verification, or be frozen while the custodian re-assesses risk. With PYMSTR there is no withdrawal step at all: stablecoins arrive in your wallet at block confirmation.
At a glance
- Custody
- Custodial hot-wallet (merchant funds pooled on CoinsPaid infrastructure; hacked July 2023 + January 2024)
- Fees
- 0.5-1.5% headline + 0.3-0.8% conversion spread + 1-3% fiat withdrawal + $25/mo inactivity (roughly 2-3.5% all-in)
- Best for
- iGaming operators who want a full-service custodial vendor with OTC and conversion, and accept the custody risk
- Not for
- Merchants unwilling to pool funds with a twice-hacked custodian, or anyone who wants flat transparent pricing
The numbers speak.
| Feature | CoinsPaid | PYMSTR Recommended |
|---|---|---|
| Who holds your money | They hold your money on their servers | We never do. It's yours instantly |
| Security Track Record | Hacked $37M (2023) + $7.5M (2024) | Nothing to hack, no fund storage |
| Transaction Fees | 0.5-1.5% headline rate | 0.5% flat. The same headline rate |
| Fees on top | Conversion spread + $25/mo inactivity | None. No spread, no inactivity fee |
| Chargebacks | Dispute process available | 0%. Transactions are final |
| Onboarding Time | KYB required. Days to weeks | 5 minutes, no KYB |
| Settlement | Custodial settlement with delays | Instant. Direct to your wallet |
Why merchants add PYMSTR.
$44.5M hacked, and counting
CoinsPaid lost $37M in July 2023 to Lazarus Group, then another $7.5M in January 2024. When a processor holds your funds, their security is your risk. PYMSTR is non-custodial. Funds go directly to your wallet. There's nothing for hackers to steal.
Hidden fees add up fast
CoinsPaid charges 0.5-1.5% per transaction, plus a 0.3-0.8% conversion spread, 1-3% for fiat withdrawals, and a $25/month inactivity fee. PYMSTR charges 0.5% flat per transaction, the same as the bottom of CoinsPaid's headline range, and nothing on top: no conversion fees, no monthly charges, no surprises.
You don't control the off-ramp
Custodial processors can freeze withdrawals, delay settlements, or require additional verification at any time. With PYMSTR, stablecoins arrive in your wallet the moment the transaction confirms. No intermediary, no delay.
Short answers. No jargon.
CoinsPaid questions.
CoinsPaid remains custodial, meaning funds are stored on their servers. While they've improved security, the custodial model itself is the risk. 95% cold storage still leaves 5% in hot wallets. PYMSTR eliminates this entirely. Funds go directly to your wallet and never touch our infrastructure.
Add the stablecoin rail to your checkout.
Non-custodial. Stable-in, stable-out. Funds settle directly to your wallet on-chain. Live in minutes, not months.