Hook
A corporate wallet holding $2.4 million USDC was drained in four minutes last October. The attacker didn’t exploit a zero-day. They simply found a private key saved as a .txt file on a shared server — named key.txt. The company, a fast-growing crypto payment gateway serving Southeast Asian merchants, had no multi-sig, no transaction simulation, and no on-chain monitoring. Their entire security posture was a conversation with the CTO over Slack. When the funds moved, the only alert was a customer complaint. This is the reality the industry has tolerated for years. Today, NOWPayments and BlockSec dropped a 25-item security checklist meant to stop this negligence. It’s free, it’s comprehensive, and it’s dangerous if treated as a finish line.
Context
NOWPayments is a payment gateway that supports 350+ cryptocurrencies and 30+ stablecoins — processing everything from coffee payments to high-value B2B invoices. BlockSec is a full-stack security provider offering audits, real-time monitoring, and threat intelligence. Their joint release, titled “25 Security Must-Haves for Secure Crypto Payment Processing,” aims to bridge the gap between onboarding and actual protection. The checklist covers nine domains: private key and wallet security, smart contract security, transaction verification and signing, identity/account/operation security, DNS and domain security, on-chain monitoring and incident response, AML/CFT technical compliance, stablecoin freeze risk management, and continuous improvement. Each domain contains multiple control items — verifiable checkpoints rather than vague principles. Andy Zhou, co-founder of BlockSec and a Chinese University of Hong Kong professor, stated that the framework emerged from observing recurring errors: weak key management, unsigned transaction approvals, and absent response plans.
Core
Let me walk through each domain with the skepticism that twenty-three years of crypto has forced into my bloodstream. I am a battle trader who has lost positions to bad code and saved them through relentless verification. My 2017 Symbiont audit taught me that security models built on paper fail when the gas war starts. My 2021 Axie Infinity gas war analysis showed me that infrastructure bottlenecks kill users faster than any exploit. This checklist is not a weapon; it is a map. Maps are useless if you cannot read them or if they omit the minefields.
Private Key and Wallet Security: The checklist correctly demands hardware wallets, multi-sig, and encrypted backups. But it does not specify which hardware wallet tolerates your transaction volume, or how to rotate keys without losing access to time-locked funds. I have seen companies implement multi-sig only to leave one signer on a hot laptop. The ledger does not care about your policy if the execution is sloppy.
Smart Contract Security: They require audits and bug bounties. Valid. But audits are snapshots; the blockchain is a living organism. I audit contracts myself — not because I trust others, but because I have debugged reentrancy attacks at 3 AM. The checklist should emphasize that audits must be repeated after each upgrade, and that automated fuzzing should run continuously. Otherwise, you are paying for a certificate that expires the moment you deploy.
Transaction Verification and Signing: The checklist mentions transaction simulation and clear signing prompts. This is where I see the most danger. A “clear signing prompt” is a UI promise, not a cryptographic guarantee. I have seen users approve malicious tokens because the prompt showed “0 ETH” but hid the approval for infinite token spending. The checklist must include a requirement to use hardware wallets that enforce transaction decoding on the device itself — something like Ledger’s blind signing override is a security hole, not a feature.
Identity/Account/Operation Security: This domain covers access controls and separation of duties. Good. But it ignores the human factor: social engineering. I have seen operations managers hand over 2FA codes over a phone call claiming to be from “IT support.” The checklist needs a section on opsec training with simulated phishing attacks. The cost of a mistake here is measured in stolen assets, not failed audits.
DNS and Domain Security: They list DNSSEC, domain locking, and email security. This is often overlooked. In 2022, a domain takeover allowed an attacker to reroute all payment callbacks to their own server for six hours before detection. The checklist should add continuous domain monitoring with alerts on registrar changes. Without that, your domain is one compromised email away from liquidation.
On-Chain Monitoring and Incident Response: This is the most critical domain and the one most likely to be implemented poorly. The checklist says “monitor for suspicious activity” — but what constitutes suspicious? In my 2025 institutional AI-agent trading protocol work, I built systems that flagged transactions based on address age, amount deviation, and contract interaction patterns. A generic monitoring tool without tuned thresholds will drown you in false positives or miss real attacks. The checklist must require specific response playbooks: if a theft occurs, how quickly can you freeze stablecoins? Which exchange contacts do you call? Andy Zhou’s comment about “tracking the fund flow” is correct, but it requires pre-established relationships, not just a checklist item.
AML/CFT Technical Compliance: This is a compliance nightmare. They require screening against sanctions lists and OFAC compliance. But screening is not a one-time event; addresses change hands. I have seen companies screen at onboarding and then never re-screen existing wallets. A controlled address can become dirty after six months of trading. The checklist should mandate periodic re-screening and transaction-level screening for each payment. Otherwise, you are one regulatory audit away from fines that dwarf the cost of non-compliance.
Stablecoin Freeze Risk Management: This is forward-thinking. Stablecoins like USDT and USDC can freeze addresses by issuer request. The checklist suggests diversifying stablecoin holdings and having conversion plans. But the real risk is that a frozen asset is trapped in a smart contract with no escape. I have personally spent weeks modeling how to extract USDC from a lending protocol after a blacklist. The checklist should include a technical runbook: how to deploy a sweep contract that moves funds to frozen-proof addresses before the blacklist propagates.
Continuous Improvement: The final domain calls for regular updates. This is the weakest link. A checklist that is not updated quarterly becomes a liability. I have seen companies follow the 2023 version of a security checklist in 2026, unaware that new attack vectors — like intent-based MEV extraction or cross-chain message forgery — have emerged. The checklist should be a living document, version-controlled on GitHub, with a changelog and community contributions. Otherwise, it is just a historical artifact.
Now, let me add something from my own experience that this checklist fails to capture. In my 2020 Uniswap V2 liquidity migration, I lost 12% to impermanent loss not because I didn’t check a box, but because I lacked a quantitative model for risk-adjusted yield. The same applies to security: a checklist checks presence, not effectiveness. A company can check “Hardware wallet in use” while the hardware wallet’s seed is stored in a Google Doc. The verification must be cryptographic, not administrative.
Contrarian
The conventional take is that this checklist is a net positive for the industry. It is. But I argue it introduces a subtle trap: false confidence. A C-suite executive reads the list, signs off on “audit completed” and “monitoring in place,” and assumes the company is secure. Meanwhile, the monitoring system misses an anomalous contract interaction because it was tuned for volume, not behavior. The checklist becomes a shield against scrutiny rather than a tool for improvement.
Worse, the checklist’s joint origin — NOWPayments and BlockSec — creates an inherent conflict of interest. NOWPayments is a payment processor; BlockSec is a security vendor. The checklist inevitably nudges users toward NOWPayments’ infrastructure and BlockSec’s services. This is not malicious, but it is biased. For example, the “transaction verification” domain could be satisfied by NOWPayments’ own API, while a competitor might offer more transparent signing. Users should treat the checklist as a starting point and independently evaluate vendors.
Another blind spot: the checklist says nothing about the security of the underlying blockchain network. If you process payments on a chain with low finality or high reorg risk, your transaction confirmation is vulnerable. I have seen merchants accept a payment shown as confirmed on a low-security chain, only to have the block reorganized and the payment vanish. The checklist should require users to define minimum confirmation thresholds per asset and chain.
Finally, the checklist ignores the operational burden. A small merchant with one employee cannot implement all 25 items. The checklist should tier its requirements: essential, recommended, advanced. Otherwise, it creates an all-or-nothing barrier that discourages small actors from adopting any security at all.
Takeaway
Security is not a box to check; it is a continuous process of verification and adaptation. This checklist is a starting point for conversations, not a substitute for a battle-tested risk model. The question every company must ask is not “Did we finish the checklist?” but “Would our wallet survive a direct attack from a professional exploit team?” If the answer is “I don’t know,” the checklist has failed you. Do not let a shared JSON file named key.txt be your only lesson. Verify the hash, not the hype. When the code bleeds, only the ledger survives.
Signature: When the code bleeds, only the ledger survives. / Yield is the shadow cast by risk taken. / Chaos is just data waiting for a ledger.