Security
How CryBit protects your funds
CryBit is a young platform, so trust has to be earned with specifics rather than claimed in general terms. Here is exactly what protects a payment from address to balance.
A unique address per invoice
Every invoice gets its own deposit address, derived from a hierarchical wallet. Addresses are never reused between customers or orders.
Automatic sweep to treasury
Funds move from the one-time invoice address to secured treasury wallets shortly after payment, instead of sitting on addresses whose keys were only just generated.
Keys encrypted at rest
Private keys and seed material are encrypted in the database, not stored as plain text.
Two-factor confirmation on money movements
Staff actions that settle, refund or move funds require a one-time TOTP code and are written to an audit log with a reason.
Signed, verifiable webhooks
Every webhook carries an HMAC-SHA256 signature over the raw body, so your server can confirm it really came from CryBit before trusting it.
Login protection
Sign-in attempts are rate-limited against brute force, and two-factor authentication (TOTP) is available for merchant accounts.
Idempotent settlement
Payments are processed through a queue with a per-invoice lock: a retried job cannot credit the same payment twice.
Independently checkable
The public status page reports live uptime, and the blockchain explorer lets anyone look up a CryBit payment on-chain without asking support.
Found a security issue?
Message the CryBit Telegram directly and describe the issue in enough detail to reproduce it. Do not test findings against real merchant accounts or funds.