Beyond the Binance incident: how CryptoProcessing protects business payments and transactions

Accepting, converting, holding, and sending cryptocurrency exposes a business to several risks at once: the wallets that hold funds, the integration that connects a store or platform to a processor, the team members who can approve transfers, and outgoing payments that can’t be reversed once confirmed. A weakness in any one of them can matter more than the strength of the others.

CryptoProcessing by Coinspaid takes a layered approach: wallet and fund protection, withdrawal authorization, transaction monitoring, compliance, API and integration security, and independent assessments. None of these layers makes a payment operation risk-free, and each works best when the business configures it properly.

Chainalysis tracked between $1.7 billion and $3.7 billion in stolen crypto every year from 2022 to 2025.

Bar chart of crypto funds stolen per year according to Chainalysis: $3.7 billion in 2022, $1.7 billion in 2023, $2.2 billion in 2024, and $3.4 billion in 2025.

Source: Chainalysis Crypto Crime Reports. The 2025 figure covers January to early December.

Why recent crypto security incidents highlight the importance of payment infrastructure protection

On October 30, 2026, Binance published a security incident update. Its initial investigation suggested that the incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance said it had found no evidence of a wallet private key leak and would share a detailed technical post-mortem once the facts are verified. According to Binance, the total impact is estimated at around $6.3 billion, with roughly $3 billion frozen on-chain so far. A later update said the investigation had found additional points of breach. Although the investigation is still ongoing, the analysis of the Ethereum blockchain activity shows an EIP-7702 protocol malicious delegation, which allows the contract holder to initiate transactions. All of this is preliminary, and the root cause hasn’t been confirmed.

Whatever the final findings show, the case raises a question for any business that moves funds: who can request a withdrawal, who has to approve it, and what happens when one device or credential is compromised? A private key can stay protected while the people, devices, and software around it become the route to a transaction. That’s why access controls, withdrawal authorization, transaction monitoring, and incident response sit alongside key storage, and why enterprises should assess security at the infrastructure level and the operational level, including their own side of an integration.

The sections below describe the controls CryptoProcessing applies at each of those layers.

How does CryptoProcessing protect business crypto payments?

CryptoProcessing combines six layers, summarized below. A later table shows which merchant-facing controls belong to which product.

How CryptoProcessing protects business wallets and funds

Cold-first custody and balance thresholds

CryptoProcessing uses a cold-first custody model. Most client assets are held offline, segregated from the hot wallets that service live payments, and those hot wallets hold only the liquidity needed for processing. Client funds are kept separate from CryptoProcessing’s own operating funds, and merchants who’d rather not hold crypto can settle to a bank account in fiat. CryptoProcessing also strongly discourages clients from using its solutions to store and hold unnecessarily large amounts of funds.

Merchants decide how much stays operational: a keep-on-hot amount and a minimum transfer amount are set per currency, and anything above the threshold is swept automatically to a cold address. A smaller hot balance means less value is exposed if a credential, an integration, or a device is compromised. Withdrawals from cold storage require multi-signature approval, with multiple independent signers and enforced separation of duties.

Roles and two-factor authentication

Day-to-day access follows least privilege. Dashboard users hold roles from view-only to Owner, and the Owner role, which manages API keys, callbacks, limits, and withdrawals, is assigned through CryptoProcessing support. Sensitive actions such as setting limits, generating API keys, and sending payouts require two-factor authentication.

Withdrawal limits and approvals

Withdrawal limits add a second check.

• A merchant can cap a single operation and set hourly and daily totals, as a default or per currency, with dashboard and API withdrawals configured separately.
• A withdrawal over a limit waits in a pending state until an Owner approves or declines it, and for dashboard withdrawals the approver must be a different Owner from the creator.
• Merchants can also route every withdrawal to manual approval.

These controls narrow what any single account, key, or device can do alone, but only as configured: with no limits defined, withdrawals are unlimited.

How transactions are monitored for suspicious activity

Real-time risk scoring and screening

Every inbound and outbound transaction is risk-scored in real time as part of KYT and AML monitoring. Screening runs against two independent blockchain analytics providers, Chainalysis and Crystal, alongside CryptoProcessing’s own systems, so one provider’s blind spot doesn’t decide the outcome. In-house rules flag unusual patterns, monitoring continues after settlement, and a security operations team watches the platform, wallet infrastructure, and on-chain flows around the clock.

Review and escalation

Analysts in the in-house compliance team review flagged transactions and escalate them before settlement where needed. The MLRO and AML officers report to the board, and suspicious activity reporting is handled internally.

Using the risk score

For payment acceptance, the risk score travels with each deposit callback, so a merchant can build it into its own order or release logic. For outgoing transfers, the same scoring applies to withdrawals and payouts, adding a line of review behind the merchant’s own approvals.

How CryptoProcessing secures API integrations

Authenticated requests

Every authenticated API request carries the merchant’s API key and an HMAC-SHA512 signature generated from the exact request body with a secret key. If the body changes after signing, the request is rejected. The secret key is displayed once, at activation, and generating or activating a key requires the Owner role and a 2FA code.

Signed callbacks

Callbacks, the notifications that report deposits, withdrawals, exchanges, and invoice payments, use the same signing scheme. The merchant’s system recomputes the signature, compares it with the header value, and checks the transaction ID against those already processed before acting on the event. Callback endpoints must use HTTPS.

Network controls, encryption, and testing

• Merchants can restrict API requests to their own IP addresses, after which requests from anywhere else are blocked.
• They can allowlist the addresses CryptoProcessing uses to deliver callbacks.
• Data is encrypted in transit and at rest.
• A separate sandbox lets teams test an integration before it touches production funds.
• Only Owners manage keys and callback settings.

Payment status verification

Payment statuses arrive through these signed callbacks, and any transaction ID can be checked against a public blockchain explorer. Developers building the integration can start with the integration guide for developers.

How CryptoProcessing secures mass payouts and withdrawals

Outgoing transactions need extra controls because confirmed transfers are generally final, and a batch multiplies the effect of one bad file or one compromised account. That matters most for high-volume businesses.

Checks before sending

A mass payout starts with a CSV upload.

• The platform validates each row, flags errors such as an invalid address or mismatched currency in a preview before anything is sent, and shows a total estimate.
• Only users with the Owner role can create a payout; sending requires a 2FA code.
• Recipient addresses can be saved as contacts, which only Owners can create.
• The platform checks each address format against its network.

Limits and approvals

A mass payout follows the same withdrawal limits as any other withdrawal. If a transaction in the batch exceeds a limit, it is held for another Owner’s approval and the payout shows a moderation status until a decision is made. Outbound transactions are risk-scored like inbound ones, and email notifications can alert the team to pending approvals.

Tracking and audit records

After sending, each row becomes its own transaction with a visible status. Failed rows can be reviewed and retried, and the transaction history keeps a note for each payment as an audit record.

What role does compliance play in payment security?

KYB, sanctions, and AML controls

• KYB onboarding verifies identity, beneficial ownership, and sanctions exposure before a merchant is activated.
• High-risk profiles go through enhanced due diligence.
• Ongoing screening covers EU, UN, OFAC, and HMT sanctions lists, as well as PEP and adverse-media checks.
• The AML framework also covers transaction monitoring, staff training, cooperation with authorities, and the Travel Rule.
• Risk assessment continues after onboarding.
• Every transaction stays traceable through its transaction ID.

Security controls and regulatory authorization

Security controls and regulatory authorization answer different questions. Controls describe how a provider protects funds and data. Authorization describes which legal entity may offer which services in which jurisdiction. A license says nothing about control quality, and strong controls can’t stand in for a license. CryptoProcessing’s entities sit in different positions. Dream Finance US LLC is a FinCEN-registered money services business, and Dream Finance Processing Inc. is a registered money services business in Canada. Dream Finance OÜ’s application for authorization as a crypto-asset service provider is under review by Estonia’s Financial Supervision and Resolution Authority, with its activities restricted in the meantime, and Dream Finance UAB in Lithuania has temporarily suspended its services. Businesses should confirm which entity would serve them and what it can offer. This guide to choosing a crypto payment provider covers that evaluation in more depth.

How CryptoProcessing validates its security standards

ISO/IEC 27001

CryptoProcessing publishes its main evidence in the Security & Privacy pack. Its information security management system is certified to ISO/IEC 27001:2022 by Bureau Veritas, covering the Estonian and Lithuanian entities, and the certificate is public, with a second certificate published for North America.

CCSS Level 3

The platform also holds CCSS Level 3 certification, the highest level of the CryptoCurrency Security Standard, assessed by Hacken. It covers key management and wallet controls, including access, approvals, backups, and risk management, and Hacken publishes its report.

Penetration testing and continuity

10Guards and Hacken run penetration tests every year against the OWASP web application testing guideline, with manual and automated testing, business logic validation, and authorization checks. Executive letters are available, and full reports are available under NDA. Access rights are reviewed on a documented schedule, and business continuity and disaster recovery plans are tested annually.

A certificate shows that a process was audited at a point in time and guarantees no outcome, so security teams should read the scope and request the supporting documents.

How security works across CryptoProcessing products

The table lists controls documented for each product. If a control is missing from a row, it isn’t documented for that product, so confirm it with the CryptoProcessing team before relying on it.

What should enterprise clients know about their own security responsibilities?

Security is shared. CryptoProcessing runs the platform controls described above, and the merchant runs its own credentials, people, approvals, and integration code. Provider-side controls can’t cover for gaps there. General fraud-prevention practice is covered in the crypto payment security guide.

• Store the API secret key in a secrets manager, never in source code or chat. It is shown once, so generate a new key if exposure is possible.
• Give each employee the minimum role needed, keep Owners to a small group, and remove access the day someone leaves. Keep at least two Owners, because the creator of a dashboard withdrawal can’t approve it.
• Set withdrawal limits, and consider routing every withdrawal to manual approval at first. With no limits defined, the default is unlimited.
• Verify every callback signature, deduplicate by transaction ID, restrict API access to your own IP addresses, and test changes in the sandbox first.
• Keep the keep-on-hot threshold low, and settle to fiat if holding crypto isn’t part of your model.
• Report suspected compromise to CryptoProcessing support immediately, revoke affected API keys, and review recent withdrawals.

Security across the complete crypto payment lifecycle

CryptoProcessing combines cold-first custody, multi-signature and second-Owner approvals, real-time transaction monitoring, KYB and AML processes, signed API traffic, and independent assessments. Each addresses a different point where funds or data can be reached, and none works as a stand-alone guarantee.

Security also needs continuous management across payment acceptance, funds management, and payouts. Limits get adjusted, access changes with the team, and integrations evolve, so configuration and access reviews belong on a routine schedule.

To see how these controls fit your payment flows, explore CryptoProcessing’s enterprise payment solutions.

Frequently asked questions