Crypto Card Security: Understanding Settlement Risk in On-Chain Payments

Your crypto card program is live. Transactions are flowing.

Behind those transactions sits another piece of infrastructure: a wallet, operational hot wallet, or prefunding pool holding the liquidity needed to support settlement with the card networks.

Unlike a traditional treasury reserve, this wallet has to stay online, move funds frequently, and remain connected to the systems running your card program.

Those same properties create a different security model.

The question isn't just how the wallet is protected. It's how much control any person, credential, or system has over the liquidity inside it, and how much they can move before anyone notices.

MPC, multisig, and other custody models can reduce specific risks. But they don't determine what an authorized transaction is allowed to do.

Real incidents across crypto payment and financial infrastructure show why this distinction matters. From compromised private keys to excessive API permissions and privileged access, the recurring problem isn't always how an attacker gets in. It's how much they can move once they do.

Key takeaways

• Compromised hot wallets have caused significant losses across crypto payment infrastructure, including incidents involving Alphapo, CoinsPaid, and Triple-A.
• A single credential with enough authority to move funds independently can create a large blast radius, as seen in Cryptsy and the suspected Multichain compromise.
• Restricted API permissions are not automatically safe if attackers can still manipulate the system, as the 3Commas breach demonstrated.
• MPC reduces the risk of a single stolen private key, but implementation and threshold configuration still matter, as illustrated by BitForge and StablR.
• MPC protects signing authority. Spend policies help control what that authority can actually do.

The Settlement Infrastructure Behind Crypto Card Payments

When a cardholder taps or swipes, the card network authorizes the transaction in real time, then settles with the issuing side afterward. Somewhere in that flow, whether the program prefunds in stablecoin, converts on deposit, or holds a working fiat balance, there's an operational wallet that needs liquidity ready to cover it. That's the wallet this article is actually about: the hot wallet, prefunding pool, or settlement balance sitting behind the card product your users see.

It's tempting to secure this wallet the way you'd secure a treasury reserve: lock it down once, check on it periodically. It doesn't behave like a reserve, and it can't be secured like one.

Why Crypto Card Settlement Has a Different Security Model

A traditional treasury reserve is usually designed around protection and controlled access. Assets can often be isolated, moved infrequently, and subject to deliberate approval processes.

A card settlement wallet has a different job.

It needs to support a live payment product, which creates three properties that fundamentally change its risk profile.

It has to stay online.

Card authorizations happen in real time. The wallet itself, or the systems that can trigger transactions from it, needs to remain reachable so liquidity can be moved when required. That makes it difficult to isolate like a long-term reserve.

It moves constantly.

A settlement or prefunding pool can be touched throughout the day as liquidity is deposited, rebalanced, or used to support settlement. More frequent movement means more signing activity and more opportunities for an unauthorized or abnormal transaction to occur.

It's connected to multiple systems.

The wallet doesn't operate in isolation. Program managers, processors, treasury systems, internal services, and partner integrations may all have some path to the funds, directly or indirectly. Each connection introduces another credential, permission, or automated process that needs to be controlled.

Put together, these properties create a different security model from a traditional treasury reserve.

For a card program, securing the wallet therefore means more than protecting the private key. You also need to know who or what can move funds, how much they can move, and how quickly the system can stop abnormal activity.

What Real Incidents Teach Card Programs

Compromised Access: Alphapo, CoinsPaid, and Triple-A

In July 2023, crypto payment processor Alphapo, which powered deposits and withdrawals for gambling platforms, lost control of its hot wallets after their private keys were compromised. Halborn's investigation estimated the initial loss at roughly $23 million.

CoinsPaid suffered a separate $37.3 million theft on the same day. While the incidents have often been discussed together, the attack path was different. According to CoinsPaid's own investigation, attackers used social engineering to compromise an employee's computer, gained access to internal infrastructure, and eventually created withdrawal requests. CoinsPaid specifically said the attackers did not directly breach its hot wallets to acquire private keys.

That distinction matters. A settlement wallet does not have to lose its private key for an attacker to move funds. If a compromised person, application, or credential can create an authorized transaction, the result can be similar.

Three years later, a similar access-control problem appeared at Singapore-based stablecoin payments provider Triple-A. On July 25, 2026, Triple-A identified unauthorized access to operational wallets containing its own digital assets across several blockchains. According to Triple-A's public post-mortem, the attack began with social engineering, followed by privilege escalation, malware, access to production databases, abuse of legitimate API credentials, and unauthorized withdrawals. Triple-A said the incident was contained and services were restored within approximately three hours of detection.

The Triple-A incident is particularly relevant to settlement infrastructure because the affected wallets were operational wallets holding company assets, while client funds were kept separately in segregated trust accounts and were not affected. Triple-A also said it was tightening access controls, expanding real-time monitoring, and reviewing wallet exposure limits and the controls governing how and when assets can move.

Why it matters for a card program: your prefunding or settlement pool also needs to remain operational and accessible to the systems supporting your card program. That makes the access path itself part of the security boundary. The question is not only whether someone can steal a private key. It is whether a compromised person, credential, API, or internal system can initiate a transaction, and how much value that access can move before it is stopped.

Privileged access: Cryptsy and Multichain

Not every loss comes from an external attacker.

In 2014, Cryptsy CEO Paul Vernon used his control over the exchange's wallets to steal more than $1 million of customer funds, according to a 2022 U.S. Department of Justice indictment. The indictment alleges that Vernon transferred the funds into a personal cryptocurrency wallet and later into his personal bank account.

The case illustrates a simple but important failure mode: too much authority concentrated in one privileged operator can create a large blast radius.

Multichain shows a different version of the same design problem. In 2023, the bridge experienced unauthorized withdrawals of more than $125 million. Chainalysis's analysis reported that after CEO Zhaojun was detained, the team lost access to the MPC keys and infrastructure associated with his accounts. The identity of whoever moved the funds was not established, and insider involvement remained unconfirmed.

The lesson is not that MPC failed as a cryptographic technology. It is that distributed signing does not automatically mean distributed operational control. Critical infrastructure, cloud accounts, administrative credentials, and recovery processes can still create points of concentration.

Why it matters: if one engineer, operations lead, or contractor can authorize a transfer from a settlement pool without another independent control, the system has a large single-actor failure mode, regardless of the custody technology underneath it.

"Trade-only" doesn't mean risk-free: 3Commas

In December 2022, crypto trading platform 3Commas suffered a database breach that exposed API keys used to connect customer accounts to supported exchanges. Halborn's analysis estimated roughly $20 million in losses. Attackers used the stolen API credentials to perform trades on users' behalf and transfer value out of affected exchange accounts.

The important lesson is that limited permissions reduce some attack paths but do not eliminate the consequences of a compromised integration. An API does not need unrestricted withdrawal access to create financial harm if the actions it is allowed to perform can be manipulated.

Why it matters: a card program may have multiple integrations with access to settlement operations, including partner APIs, internal automation, treasury systems, and transaction services. A permission scope that looks conservative on paper still needs monitoring, transaction limits, and controls that can detect abnormal behavior before the access becomes a drain.

Three Questions to Ask About Your Settlement Wallet

Every incident above answers one of three questions. If you don't know the answer to all three for your own settlement wallet, that's the actual audit finding, not the incidents themselves.

Can one credential move funds alone?

At Multichain, one person's access being cut off was enough to jeopardize the whole system. At Cryptsy, the exchange's own CEO didn't need to hack anything, he already had the access. The fix isn't a rule against letting one person do this. It's an architecture where no single credential, whether held by a person, a server, or a script, is sufficient to sign a transaction on its own.

Can an attacker keep moving funds after the first alarm?

Triple-A detected unauthorized access and, by its own account, contained the incident within about three hours. Independent trackers still estimate the total outflow at roughly $11.8 million across a longer window before full consolidation. Real-time velocity limits, capping how much can leave the pool per hour or per day, close that gap independent of how fast the security team responds.

Can an automated system move more than it should?

At 3Commas, compromised keys mostly carried trade permissions, not withdrawal rights, and attackers still extracted value by placing manipulative trades the key was technically allowed to make. Any integration touching your settlement pool, a partner API, an internal bot, a treasury tool, needs the same scrutiny: scoped permissions, an expiry, and monitoring for behavior outside its normal pattern, not just a label like "read-only" or "trade-only."

Where MPC Helps, and Where It Doesn't

A Security Audit Checklist for Card Program Leadership

This is written for the people who own the decision, not the engineers implementing it. Each item maps back to one of the incidents above.

FAQ