PYMSTR
Launch app
Home/Comparisons/vs CoinsPaid
vs CoinsPaidhead-to-head

PYMSTR vs CoinsPaid.

Hacked twice. $44.5M lost. Still custodial.

Launch app →
//the short answerstatus check

What happened to CoinsPaid?

CoinsPaid was hit twice. In July 2023 the Lazarus Group drained roughly $37 million from CoinsPaid's pooled hot wallets. In January 2024 attackers took another $7.5 million from the same infrastructure. Both incidents exploited the custodial architecture: CoinsPaid holds merchant funds on their platform before settling, so a compromise of their systems is a compromise of every merchant balance sitting on it. $44.5 million lost across the two events.

CoinsPaid is still operating and remains one of the largest custodial crypto processors serving iGaming. That is the story: the platform absorbed the losses and kept running, but the January 2024 hit demonstrated the July 2023 hack was not a one-off. Anyone routing merchant funds through CoinsPaid today is trusting the same pooled-hot-wallet model that has now been breached twice.

Merchants evaluating CoinsPaid should look at two things: custody model (custodial: they hold your money before releasing it to you) and fee stack (0.5 to 1.5% headline plus conversion spread plus fiat withdrawal fees, roughly 2 to 3.5% all-in). A non-custodial gateway removes both. That is what PYMSTR is, the industry calls this non-custodial: money moves straight from the customer to your own wallet, no third-party balance sitting in between. 1% flat, no KYB, USDC and USDT on 5 networks.

// the facts
Hacked$44.5M total: $37M drained by the Lazarus Group in July 2023, then $7.5M in January 2024. Both hits on the pooled custodial hot wallets.
StatusStill operating. Largest custodial crypto processor in iGaming. Unresolved custody risk after two consecutive hacks.
Custody modelPooled custodial hot wallets (95% cold / 5% hot per their own disclosures). Merchant funds sit on CoinsPaid infrastructure until manual settlement.
Migration pathNon-custodial gateway. PYMSTR settles direct to your wallet, 1% flat, no KYB, USDC and USDT across 5 networks.
//Side by side3 processors

CoinsPaid vs Alphapo: the two custodial iGaming processors, side by side

CoinsPaid and Alphapo were the default crypto processors for iGaming, and both were drained in the same month. The Lazarus Group took about $37 million from CoinsPaid and about $60 million from Alphapo in July 2023: $97 million out of custodial hot wallets in one month. CoinsPaid was hit again for $7.5 million in January 2024. The difference in 2026 is continuity: CoinsPaid is still operating, Alphapo is in partial wind-down and treated as defunct by the market.

The comparison most operators actually need is not which of the two custodians to pick. It is whether to keep a custodian at all (custodial: they hold your money before it reaches you). PYMSTR never holds your money. The industry calls this non-custodial: the payment settles from the customer straight to your own wallet, so there is no pooled balance for the next hack to drain. The table puts all three next to each other.

//coinspaid vs alphapo vs pymstr · custody, hacks, fees, onboardingcompiled
ProcessorStatus in 2026HackedWho holds your moneyAll-in feeOnboardingiGaming
CoinsPaidStill operating$44.5M: $37M July 2023 + $7.5M January 2024 (Lazarus Group)Custodial (they hold your money): pooled hot wallets0.5-1.5% headline, 2-3.5% all-inKYB, days to weeksYes
AlphapoPartial wind-down, treated as defunct~$60M, July 2023 (Lazarus Group)Custodial (they hold your money): hot wallets across chainsEnterprise pricing, never publishedEnterprise-only, weeks to months, no self-serveYes, historically
PYMSTRLive, self-serveNothing to drain: we never hold your moneyNon-custodial: settles straight to your wallet1% flatNo KYB, about 5 minutesWelcome
//CoinsPaid reviewindependent assessment

CoinsPaid is the biggest name in iGaming crypto payments: a full-service custodial gateway with an OTC desk, business wallet, and an established operator client base. The catch is the architecture. CoinsPaid holds merchant funds in pooled custodial wallets, was hacked for $37M in July 2023 (Lazarus Group) and another $7.5M in January 2024, and its 0.5-1.5% headline rate roughly doubles once conversion spreads, withdrawal fees, and inactivity charges are counted.

+ Pros
Established iGaming track record
CoinsPaid has processed for iGaming operators for years and supports gambling explicitly, which most card-first crypto processors (BitPay, Coinbase) do not. For operators who want a custodial full-service provider, it is the incumbent choice.
Full-service product suite
OTC desk, business wallet, merchant dashboard, and multi-token acceptance with built-in conversion. Operators who want one custodial vendor for acceptance, conversion, and treasury get all of it in one contract.
Competitive headline rates at volume
The 0.5-1.5% volume-based transaction rate undercuts card-rail alternatives for high-risk verticals, and multi-token support widens what customers can pay with, at the cost of conversion spreads on every non-stablecoin leg.
− Cons
Hacked twice: $44.5M in losses
$37M stolen in July 2023 by the Lazarus Group via social engineering, then another $7.5M in January 2024. The stolen funds were customer deposits sitting in CoinsPaid custody, and the root cause is the custodial pooling itself. PYMSTR is non-custodial: funds settle directly to your wallet, so there is no pool to drain.
Hidden fees roughly double the headline rate
The 0.5-1.5% rate becomes roughly 2-3.5% all-in after the 0.3-0.8% conversion spread, 1-3% fiat withdrawal fees, and a $25/month inactivity fee after 90 days of dormancy. PYMSTR charges 1% flat with no spreads, no withdrawal fees, and no monthly charges.
KYB onboarding takes days to weeks
As a custodian of merchant funds, CoinsPaid must underwrite each merchant: KYB documentation, contracts, and compliance review before the first payment. PYMSTR onboarding is 5 minutes with no KYB, because the non-custodial architecture removes the underwriting requirement.
The custodian controls your off-ramp
Withdrawals route through CoinsPaid. They can be delayed, require additional verification, or be frozen while the custodian re-assesses risk. With PYMSTR there is no withdrawal step at all: stablecoins arrive in your wallet at block confirmation.
// at a glance
CustodyCustodial hot-wallet (merchant funds pooled on CoinsPaid infrastructure; hacked July 2023 + January 2024)
Fees0.5-1.5% headline + 0.3-0.8% conversion spread + 1-3% fiat withdrawal + $25/mo inactivity (roughly 2-3.5% all-in)
Best foriGaming operators who want a full-service custodial vendor with OTC and conversion, and accept the custody risk
Not forMerchants unwilling to pool funds with a twice-hacked custodian, or anyone who wants flat transparent pricing
//The numbers6 dimensions

The numbers speak.

Who holds your money

PYMSTR

We never do. It's yours instantly

CoinsPaid

They hold your money on their servers

Security Track Record

PYMSTR

Nothing to hack, no fund storage

CoinsPaid

Hacked $37M (2023) + $7.5M (2024)

Transaction Fees

PYMSTR

1% flat, no hidden fees

CoinsPaid

0.5-1.5% + conversion spread + $25/mo inactivity

Chargebacks

PYMSTR

0%. Transactions are final

CoinsPaid

Dispute process available

Onboarding Time

PYMSTR

5 minutes, no KYB

CoinsPaid

KYB required. Days to weeks

Settlement

PYMSTR

Instant. Direct to your wallet

CoinsPaid

Custodial settlement with delays

//Why operators add PYMSTR3 reasons

Why merchants add PYMSTR.

01

$44.5M hacked, and counting

CoinsPaid lost $37M in July 2023 to Lazarus Group, then another $7.5M in January 2024. When a processor holds your funds, their security is your risk. PYMSTR is non-custodial. Funds go directly to your wallet. There's nothing for hackers to steal.

02

Hidden fees add up fast

CoinsPaid charges 0.5-1.5% per transaction, plus a 0.3-0.8% conversion spread, 1-3% for fiat withdrawals, and a $25/month inactivity fee. PYMSTR charges 1% flat per transaction. No conversion fees, no monthly charges, no surprises.

03

You don't control the off-ramp

Custodial processors can freeze withdrawals, delay settlements, or require additional verification at any time. With PYMSTR, stablecoins arrive in your wallet the moment the transaction confirms. No intermediary, no delay.

//CoinsPaid questions7 answers

Short
answers.
No jargon.

CoinsPaid remains custodial, meaning funds are stored on their servers. While they've improved security, the custodial model itself is the risk. 95% cold storage still leaves 5% in hot wallets. PYMSTR eliminates this entirely. Funds go directly to your wallet and never touch our infrastructure.
PYMSTR is non-custodial. We never hold, store, or have access to merchant funds. Payments flow directly from customer to merchant wallet on-chain. There are no pooled funds for attackers to target.
Yes. Sign up via wallet connection or social login, an embedded wallet is created automatically in your dashboard. Start accepting payments in minutes. No KYB, no waiting. You can run both processors in parallel during your transition.
Yes. PYMSTR is built for high-risk merchants including iGaming operators. Unlike processors that restrict gambling, we welcome it with 1% flat fees and no volume limits.
Both CoinsPaid and Alphapo are custodial crypto payment processors that have suffered major hacks. CoinsPaid lost $44.5M across two incidents (2023 and 2024). Alphapo lost $60M to the Lazarus Group in 2023. Both hold merchant funds on their own servers, which is the root cause of the hack risk. PYMSTR is the non-custodial alternative to both: funds settle directly to your wallet, so there is nothing for attackers to take. The dedicated Alphapo comparison is available at /vs/alphapo.
Yes. CoinsPaid is still operational and remains one of the largest custodial crypto payment processors in the iGaming space. What changed is not the company's status but the risk model: after the July 2023 hack ($37M) and the January 2024 hack ($7.5M), merchants are trusting the same pooled-hot-wallet infrastructure that has now been breached twice. If custody risk is the reason you are looking at alternatives, a non-custodial gateway removes it entirely.
Two separate incidents. In July 2023 the Lazarus Group drained roughly $37 million from CoinsPaid's pooled hot wallets. In January 2024 attackers took an additional $7.5 million from the same infrastructure. $44.5 million lost across the two events. Both exploited the same architectural pattern: CoinsPaid holds merchant funds on their platform before settling, so a breach of their systems is a breach of every merchant balance on it. Non-custodial gateways do not pool funds, so this class of attack is architecturally impossible against them.
More comparisons
Key advantages
Deep dive

Add the stablecoin rail to your checkout.

Non-custodial. Stable-in, stable-out. Funds settle directly to your wallet on-chain. Live in minutes, not months.

Launch app →