Crypto payment security: a checklist for merchants

Most losses in crypto payments do not come from breaking a blockchain. They come from a leaked key, a fake payment page or an order confirmed on someone's word. This checklist covers the steps that matter most.

Protect your account

• Turn on two-factor authentication with an authenticator app and store the recovery codes offline.
• Use a unique, long password, ideally from a password manager.
• Check the list of active sessions and end the ones you do not recognise.

Protect your API keys

• Keep the private key on the server only. Never put it in a browser page, a mobile app or a public repository.
• If a key may have leaked, reissue it at once: the old one stops working immediately.
• Use separate merchants and keys for separate sites.

Confirm payments safely

• Confirm an order only when the invoice status is paid, from your server, not from a browser event.
• Verify the signature of every webhook and reject old requests.
• Handle webhooks idempotently so a repeat delivery does not ship an order twice.
• Serve your site and your webhook endpoint over HTTPS.

Watch for phishing

Attackers copy payment pages and send customers to look-alike domains. Send customers only to the official payment page address and tell them what it looks like. Never accept a screenshot of a transfer as proof of payment.

Screen incoming funds

Use a gateway that screens incoming transfers against sanctions and risk lists. On CryBit a high-risk transfer is not credited to the merchant and is returned to the sender minus the network fee.