On 2 August 2026 a merchant posted to BlackHatWorld saying they had lost more than $75,000 in crypto held on a digital-goods selling platform. A second merchant replied in the same thread claiming around $150,000.
Both describe the same sequence. A forced migration to a new version of the platform, with a dialog that blocked the dashboard until they accepted. Balances moved to newly generated wallets. No seed phrase and no encryption key handed over. The coins visible, on-chain, and unspendable.
We are not going to tell you what happened inside those companies. We do not know, the people involved have given different accounts, and a payments company accusing another payments company of theft on its own blog is worth exactly nothing to you. The claims are the merchants'; the responses given so far include a wallet-size migration and a third-party breach.
What is worth your time is the mechanism, because the mechanism is not exotic. It is the default almost everywhere, it is probably how your current processor works, and nothing about it requires anyone to be dishonest for you to end up in the same position.
The part that is not in dispute
Whatever the intent, one fact is structural and both sides agree on it: the platform could move the money without the merchant.
That is the whole thing. Not fraud, not negligence, not a breach — capability. If a company can move your balance without your key, then your balance is not protected by cryptography. It is protected by that company's continued solvency, competence and good behaviour.
Those are fine things to have. They are not guarantees, and crucially they are not things you can verify. You cannot audit a private company's runway. You cannot tell from the outside whether the key that controls your money is in an HSM or in an environment variable. You find out when you find out.
What "custodial" actually means
The word gets used as a compliance category. It is simpler than that.
Custodial means a payment address was generated by the processor, from a key the processor holds. Coins sent there are theirs in every sense that matters to a blockchain — they can sign, you cannot. Your balance is a number in their database saying what they owe you. Withdrawing is a request.
Non-custodial means the address was derived from a key you hold. Coins sent there are yours the moment they confirm. There is no balance to withdraw, because nothing ever moved anywhere else. The processor watches the chain and tells you when the money arrived.
Same checkout. Same buyer experience. Completely different failure mode.
The difference only shows up on the bad day, which is why it is so easy to discount. A custodial processor and a non-custodial one look identical for years. They diverge exactly once.
Why processors hold keys anyway
It is not laziness. Custody is genuinely easier to build and it unlocks features you cannot otherwise offer.
Holding balances means you can net payments against refunds, take a percentage without an invoice, offer instant conversion to stablecoins, cover chargebacks, and show a tidy single balance instead of coins scattered across chains. It also means float — customer money sitting on your books, which is a business in itself, and one that becomes very tempting when the primary business is struggling.
We gave all of that up. It costs us real product surface and it is the reason some things you might want are things we cannot do. That is the trade, and it is worth being straight about it rather than pretending non-custodial is free.
What we do instead
You give Blockra an extended public key — an xpub. It derives addresses. It cannot sign.
Every crypto payment gets a fresh address derived from that key. The buyer pays it. We watch the chain, confirm it, mark the order paid, fire your webhook, deliver the product. At no point do the coins touch an address we can spend from, because we do not have the key that would let us.
There is no withdrawal button, because there is nothing to withdraw. The money was already in your wallet when it confirmed.
The dashboard wallet is the same idea. If you use it, the signing key is generated in your browser, encrypted with your password in your browser, and the encrypted blob is what we store. We cannot decrypt it. If you forget the password we cannot help you, which is a genuinely worse support experience and the honest cost of not being able to take your money.
Cards and bank payments work the same way in spirit: they settle through your Stripe or GoCardless account. The payout goes from the processor to your bank. We are not in the path.
The questions worth asking your current processor
Not just ours. Any of them, including whoever you are with now:
- Who generated the address my customers pay? If it is them, it is custodial, whatever the marketing page says.
- Can you move my balance without my signature? If yes, everything else is a policy that can change.
- Where does a card payout land? Your bank via your own processor account, or their account first?
- What happens to my balance if you shut down tomorrow? A company that has not thought about this in public has not thought about it.
- Am I giving you an xpub or are you giving me an address? This one question separates the two models faster than any amount of documentation.
A processor that answers these plainly is one worth considering. Evasion on question two is the answer.
If you are holding a balance somewhere right now
The single highest-value thing you can do today, regardless of who you use: withdraw it. Not because your processor is dishonest — because a balance you have not withdrawn is a bet on a company you cannot audit, and the merchants in that thread lost a year of work to exactly that bet.
The first merchant said it themselves: "We understand our mistake for not moving the crypto." We would not call it a mistake so much as a default that the whole industry encourages. But the practical advice stands. Sweep it. Weekly, on a calendar reminder, whatever it takes.
And if you are choosing a processor, choose one where the question does not come up.
Blockra is a non-custodial payment gateway for cards and crypto. Crypto derives from your own extended public key; cards and bank payments settle through your own Stripe and GoCardless accounts. There is no balance page, because we never hold the money.
Sources: the merchant reports quoted here are from a public BlackHatWorld thread dated 2 August 2026, together with the wallet addresses posted in it. We have not independently verified the on-chain claims and take no position on the intent of any company named there.