Crypto payment providers all claim to be secure. What matters is which failures they have designed out, and what happens on the day something breaks. Here is ours, specifically.
You configure an extended public key (xpub) and nothing else. Coinflux derives a fresh watch-only address for each deposit and reads the chain, but it holds no private key and cannot sign a transaction. Deposits land directly in wallets only you control. There is no pooled hot wallet — which is precisely what was drained for roughly $60M at the custodial processor Alphapo in 2023.
Every credit carries an idempotency key made of the network, the transaction hash and the receiving address, enforced by a UNIQUE constraint inside a database transaction. Replaying the same transfer — a retried job, two watchers racing, a manual re-run — writes nothing the second time. Double-crediting is not unlikely here; it is impossible.
Your endpoint will go down at some point. Every notification is written to a queue before it is sent and retried with exponential backoff for up to 24 hours, then parked in a dead-letter queue you can inspect and replay from the dashboard. Each attempt repeats the same delivery id, so your backend can safely discard one it has already handled.
A player who pays after the deposit window closed has still sent real USDT. A reconciler re-checks issued addresses regardless of deposit status and credits those payments, flagged as late so your backend can tell them from a normal credit. Anything that reaches an address whose deposit already settled goes to a review queue instead of vanishing.
Two-factor authentication is mandatory for every dashboard user. Changing the settings that decide where money goes — the xpub, the webhook URL — asks for a fresh code even inside a live session, so an attacker holding a valid session still cannot redirect your funds. Login is rate limited per account, not just per IP.
The watcher is the only thing turning an on-chain payment into a credit, so its health is public to you: a health endpoint reports the last successful chain read and any errors, and if the chain goes unread while deposits are waiting, an alarm is raised. A payment system that fails silently is the one that costs you money.
No. Operators configure only an extended public key (xpub). Coinflux derives and watches receive addresses but holds no private keys and can never move funds. An optional managed-custody mode exists for operators who explicitly want it.
Coinflux never holds operator funds, so there is no pooled hot wallet to drain. Deposits land directly in addresses derived from the operator’s own xpub. This removes the class of risk that cost the custodial processor Alphapo roughly $60M in 2023.
Every credit carries a unique idempotency key — network, transaction hash and address — enforced by a UNIQUE constraint inside a database transaction. Re-processing the same blockchain transfer is a no-op, so double-crediting is impossible rather than unlikely.
Nothing is lost. Every notification is persisted before it is sent and retried with exponential backoff for up to 24 hours, then kept in a dead-letter queue you can replay from the dashboard. Each attempt carries a stable delivery id so your backend can discard duplicates.
A reconciler re-checks issued addresses regardless of deposit status and credits late payments, flagging them so your backend can tell them apart. Money that reaches a settled address lands in a review queue instead of being lost.
Yes, and it is mandatory. Every dashboard user enrolls a TOTP authenticator; changing the wallet xpub or webhook URL additionally requires a fresh code, so a stolen password cannot redirect your funds.
The custodial trade-off in full: non-custodial vs custodial for iGaming →