CoinsPaid

Documented events with consequences still open. Each entry carries a source and a date.

1. Jun 30, 2026 Delisting / service stop Severe ● open

   MiCA: the Lithuanian subsidiary has suspended ALL crypto-asset services, and the Estonian entity has restricted its activity pending CASP authorisation

   This is not an attack: it is the move to MiCA, and for anyone collecting money through this gateway it matters more than an attack. In an update signed by CEO Max Krupyshev and published on the official site of the CryptoProcessing by CoinsPaid brand, the company states that Dream Finance OÜ's application for authorisation as a Crypto-Asset Service Provider (CASP) "remains under review", and that the company "has restricted its activities in line with the approach published by the Estonian Financial Supervision and Resolution Authority following the end of the transitional period". On the Lithuanian subsidiary the wording is blunter: "Dream Finance UAB (Lithuania) has temporarily suspended the provision of all crypto-asset-related services, including the registration of new clients, the execution of transactions, and the conclusion of new contracts." WHAT THIS MEANS IN PRACTICE. On the Lithuanian entity no accounts are opened, no contracts are signed and — per the company's own text — no transactions are executed. On the Estonian entity activity continues in restricted form: no new clients, no new contracts, no expansion of services to existing clients, no marketing of regulated services in the European Economic Area, pending the authority's decision. THE DATE AND THE STATUS. The date is that of the official update, 30 June 2026: the company does not state the day the suspension began, and we do not invent one. We opened the official page on 26 September 2026 and the text is still the same, in the present tense: no resumption announced, no authorisation decision made public. We record it as "open" rather than as an emergency in progress — it is a regulatory transition, not an event unfolding — but it remains a live constraint on the service, not a historical footnote.

   ↗ source
2. Jan 5, 2024 Hack / funds theft Severe $8M ● open

   Second theft in six months: $7.5 million moved out on BNB Chain and Ethereum, spotted by an outside firm. The company never commented publicly

   Six months after the $37.3 million theft, CoinsPaid was hit again. The alert did not come from the company but from outside: security firm Cyvers detected anomalous transactions and its CEO Deddy Lavid gave the precise time — "on January 5, 2024, at 6:13:23 PM UTC" — and the total: $7.5 million across BNB Chain and Ethereum. The reported composition is $6.1 million in USDT, ETH and USDC, over $1 million in BNB and roughly $368,000 in CoinsPaid's own CPD token, swapped into ETH. The funds moved to externally owned accounts and other exchanges, including MEXC, WhiteBIT and ChangeNOW; WhiteBIT said it had frozen what arrived from there. A NOTE ON THE DATE. Several outlets date the episode to 6 January 2024, which is the day the detection became public; here the date is the one matching the UTC timestamp given by whoever measured it, 5 January. It is the choice we always make: date the fact, not the news. THE SILENCE IS THE DATA POINT. Unlike July 2023, when CoinsPaid published a detailed post-mortem, on this second episode the company issued no public comment: the outlets said so in the days immediately after, and no later statement is on record. So we do not know whether the funds hit were the company's or clients', nor what the vector was, nor whether anything was recovered. When the victim does not speak, the only honest thing to write is that it does not speak.

   ↗ source
3. Jul 22, 2023 Hack / funds theft Severe $37M ● open

   $37.3 million taken from operating wallets: the entry point was a fake job interview, and the company attributes the attack to North Korea's Lazarus group

   On 22 July 2023 CoinsPaid — the crypto payment gateway operated by Estonia's Dream Finance OÜ — lost $37.3 million. The reconstruction comes from the company itself, in a post-mortem published on its own site on 7 August 2023, and the entry point is the part worth remembering: an employee answered a fake job offer presented as coming from Crypto.com and, to complete the "test assignment" requested, installed a program containing malicious code. From there, profiles and access keys to the internal infrastructure were stolen. WHAT THE COMPANY STATES. Client funds "were not affected and are fully available": the attack hit the company's own operating wallets, not merchant balances. The attackers, CoinsPaid writes, could not breach the hot wallets or access private keys directly; the internal alarm system fired and made it possible to stop the activity and shut the access down. The company also describes the run-up: constant unsuccessful attacks logged from March 2023, ranging from social engineering to DDoS and brute force, before the one that worked. On 7 July 2023, between 20:48 and 21:42, there had been a massive preparatory attack. THE ATTRIBUTION, AND WHO MAKES IT. It is the victim that names Lazarus, the group linked to North Korea, writing that it left the attackers "a record-low reward". It remains an attribution by an interested party: no authority has publicly certified it. Bloomberg reported on 28 July 2023 that the company turned to the Estonian authorities, and the episode was covered by BleepingComputer, Cointelegraph and CoinDesk. WHAT CANNOT BE SAID. In those same weeks another processor, AlphaPo, suffered a much larger theft, and several accounts add the two together to reach figures around $100 million: they are different companies, and we do not conflate them here. Nor is there any record of the $37.3 million being recovered: the "over $70 million recovered" figure in circulation refers to the several dozen cases handled by the analytics firm Match Systems as a whole, not to this incident.

   ↗ source

verified on Sep 26, 2026

Weighted average across 1 public review platform (20 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.