How to Accept Stablecoin Payments Securely

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. Use a processor that settles to fiat, or run your own wallets; either way, verify every webhook and guard your keys. Self-hosting adds token allowlists, crediting after finality, sanctions screening and keeping spending keys off checkout servers.

Watch: How to Accept Stablecoin Payments Securely 1:36

Video transcript

Stablecoin payments cannot be charged back. That removes one kind of fraud, but it also means mistakes stick.

BitPay says blockchain payments are irreversible. The network will not undo a wrong-token payment or goods shipped on a forged webhook.

Processors like Stripe and BitPay can settle to fiat. Coinbase and Shopify's Commerce Payments Protocol uses escrow on Base. Or you self-host and hold every key.

A processor takes the chain work off your desk, but you still verify its webhooks and guard your keys. Either way, an attacker who can mark an order paid does not need the chain.

If you self-host, derive addresses from an extended public key, so checkout servers cannot spend. Allowlist exact token contracts, not bridged copies like USDC dot e. Screen the payer for sanctions, then credit once the payment is final on its chain.

Without verification, Stripe warns, fake webhook events could trigger fulfillment. Verify signatures on the raw body, reject stale timestamps, drop duplicate events, and confirm high-value orders through the API or onchain.

With no chargebacks, every refund is a transfer you send. Return it to the original address and chain, with a second approver above a set amount. Treat requests for a different wallet as possible social engineering.

Guardian pentests the apps, APIs and infrastructure around payments. Read the full guide, or talk to Guardian at guardian.security.

Stablecoin payments cannot be charged back. Stripe lists dispute support for them as "No," and BitPay says "Blockchain payments are irreversible."

That removes one kind of fraud. It also means mistakes stick: the network will not undo a wrong-token payment, goods shipped on a forged webhook or a sanctioned payer's transfer.

Here are the options, and the security duties that stay with you under each.

Acceptance Options

There are three broad routes.

Payment processors

Stripe accepts USDC on Tempo, Ethereum, Solana, Polygon and Base, plus USDP and USDG in the US. Payments settle to your Stripe balance in your local currency.

US businesses can accept them, with a private preview in the EU, Hong Kong, Mexico and Switzerland. Stripe caps each customer payment at $10,000.

BitPay accepts stablecoins like USDC, and merchants can settle in fiat, crypto or a mix.

Onchain payment protocols

Coinbase and Shopify launched the Commerce Payments Protocol on Base, open to all developers. At authorization, funds move into an escrow contract; the merchant captures them later.

It powers Shopify's USDC payment method, Shopify Engineering wrote in June 2025.

Self-hosted acceptance

You generate addresses, watch the chain, credit orders and hold the keys. Every control a processor would run is now yours.

Processor vs Self-Hosted

A processor takes the chain work off your desk. It does not take all the duties.

Duty	With a processor	Self-hosted
Receiving addresses	Processor's checkout	You derive and verify them
Tokens and chains	Processor's supported list	Your strict allowlist
Crediting orders	On a verified processor event	After finality on each chain
Webhooks	Verify the processor's signatures	Secure your own chain watcher
Keys and secrets	Your API keys and webhook secrets	Receiving, sweep and refund keys
Sanctions screening	Check what the processor covers	Every payer and refund address
Refunds	Through the processor's refund flow	A new outbound transfer you sign

Under both, your app, API and admin panel decide who gets goods. An attacker who can mark an order paid does not need the chain.

Wallet and Settlement Controls

Address generation and verification

Keep spending keys off the server that creates checkout addresses. BIP-32 lets a server derive fresh receiving addresses from an extended public key, with no power to spend.

BIP-32 also warns that the parent extended public key plus any non-hardened child private key reveals the parent private key. Treat the xpub as sensitive.

Then check that the address the customer sees is the one you issued. A tampered checkout page or script can swap it.

Token and chain allowlists

Credit only exact token contracts on chains you support. Circle publishes native USDC addresses per chain, such as 0xaf88...5831 on Arbitrum.

Bridged USDC.e is a different token. Circle says it "supports only USDC" and has no obligation to support copies or wrappers. See USDC.e vs USDC.

Quarantine everything else: lookalike tokens with the right symbol, the wrong chain, or a bridged version.

Confirmation before crediting

Credit an order when the payment is final on its chain, not when it first appears. Set the depth per chain and per amount.

Our guide to settlement finality by chain includes a crediting policy.

Match each payment to one order by token, chain, address and amount. Decide in advance how you handle underpayments, overpayments and late payments.

Webhook verification

Without verification, "an attacker could send fake webhook events to your endpoint to trigger actions like fulfilling orders," Stripe warns.

Stripe signs each event with HMAC SHA-256 in a Stripe-Signature header that includes a timestamp. Its libraries reject events older than 5 minutes by default.

Verify the signature on the raw body, with a constant-time compare.
Reject stale timestamps, and log event IDs to drop duplicates.
Do not depend on event order; Stripe does not guarantee it.
Before shipping a high-value order, confirm payment through the API or onchain.

More in our guide to crypto payment webhook security.

Key custody

Separate the keys that receive, sweep and refund. A server that only receives never needs a signing key.

Keep sweep and refund keys behind approvals and limits, in an MPC wallet, an HSM or a multisig.

Sanctions screening

OFAC says sanctions compliance obligations "apply equally to transactions involving virtual currencies and those involving traditional fiat currencies." Its civil penalties generally rest on strict liability.

Since 2018, OFAC has listed some crypto addresses on its SDN List. Its guidance recommends tools to block transactions tied to them, plus geolocation and IP blocking.

Screen paying addresses before crediting, and refund addresses before sending. Circle also reserves the right to block USDC transfers to and from an address.

Refunds and Disputes

There is no chargeback. A refund is a new transfer that you send.

Stripe returns stablecoin refunds to the customer's original wallet. The Commerce Payments Protocol allows refunds until an expiry, after which "captured payments are considered final."

If you self-host, write the rules down:

Refund to the original address, unless the customer proves control of a new one.
Refund in the token and on the chain you received.
Require a second approver above a set amount.
Screen the refund address again at send time.
Decide who absorbs gas and price changes.

Treat any request to refund to a different wallet as a possible social engineering attempt.

Reconciliation and Records

Reconcile three records daily: orders, onchain receipts and wallet balances. Every gap is a bug or an attack until proven otherwise.

Store the transaction hash, chain, token contract, USD value at receipt and screening result with each order.

Tax and accounting treatment varies by jurisdiction. Confirm how to record stablecoin receipts with your accountant.

How Guardian Helps

Guardian pentests the systems around payments for fintechs. Web app tests cover value-moving flows and business logic; API tests cover per-object authorization and replay.

Infrastructure tests cover cloud IAM and secrets handling: the places a signing key or webhook secret can leak.

Managed Security keeps those controls in place as you grow, with Shield watching every internet-facing surface. A trust center turns the work into evidence for banks and partners.

Frequently Asked Questions

Can stablecoin payments be reversed?

Not by the network. There are no chargebacks; a refund is a new transfer from the merchant. Stripe lists no dispute support for stablecoin payments and returns refunds as stablecoins to the customer's original wallet.

Do I have to hold crypto to accept stablecoin payments?

No. Stripe settles stablecoin payments to your Stripe balance in local currency, and BitPay can settle in fiat. You still own order crediting, refunds and webhook security.

When should I credit a stablecoin payment?

When the transaction is final on its chain and matches the order's token contract, chain, address and amount. Set confirmation depth per chain and per amount, and never credit on an unverified webhook.

Is USDC.e the same as USDC?

No. USDC.e is bridged USDC minted by a third-party bridge, and Circle does not issue it. Allowlist the native USDC contract address Circle publishes for each chain, and treat USDC.e as a separate asset.

Sources

Test your stablecoin checkout before attackers do

Guardian pentests the app, API and infrastructure that decide when an order is paid and where a refund goes.

Talk to Guardian Explore fintech security