I’ve seen three payment gateways drained in the last eighteen months. Each one had a checklist. Each one thought they were covered. The attackers didn’t care about their list. They exploited the gaps between the items.
Now NOWPayments and BlockSec have released a joint security checklist. Twenty-five controls across nine domains. Free. Printable. Designed to turn broad security principles into actionable checkpoints. On the surface, it looks like a gift to the industry. Under the hood, it’s a mirror reflecting how far we still are from true payment security.
Context
The checklist covers private key and wallet security, smart contract risks, transaction verification, identity and operations, DNS security, on-chain monitoring, AML/CFT technical compliance, stablecoin freeze management, and continuous improvement. Each control is a yes/no check. Andy Zhou, BlockSec co-founder and Chinese University of Hong Kong professor, emphasized that common mistakes—weak key management, unverified transaction approvals, blind trust in third-party APIs—are exactly what this list aims to prevent. It’s a structured approach to an unstructured problem.
But a checklist is not a system. It’s a static document. The checklist itself admits it’s a shared record, not an automated execution layer. This is where the danger begins.
Core
Let me deconstruct this from my experience auditing DeFi payment protocols. The checklist does several things right. It forces teams to think about key rotation schedules, multi-signature thresholds, and fallback custody. It explicitly includes stablecoin freeze risk—a niche but increasingly critical topic. The inclusion of chain monitoring and event response shows awareness that security is not a one-time setup but a continuous loop.
However, the omissions are louder than the inclusions.
First, there is no guidance on cross-chain atomicity. Payment flows today rarely stay on one chain. A merchant accepts USDC on Ethereum, converts to BNB on BNB Chain via a swap, then settles on Polygon. Each bridge and swap introduces a new surface. The checklist treats each chain as an isolated universe. In reality, the chain is the weakest link.
Second, MEV protection is absent. On-chain payment settlements are visible in the mempool. Front-running bots can sandwich merchant transactions, extracting value. A simple approval confirmation is not enough if the transaction can be reordered. I’ve seen a protocol lose $800k to a sandwich attack on a simple USDT transfer. The checklist doesn’t even mention slippage controls or private mempool usage.
Third, and most critically, the checklist is a manual exercise. No automation. No integration with monitoring tools. The team checks boxes quarterly and calls it done. But attacks happen between checkups. I audited a payment platform that followed a similar self-assessment. They had a perfect score on paper. Three months later, an attacker exploited a stale API key that wasn’t rotated because the key rotation policy was buried on page 17 of a PDF. The checklist didn’t enforce anything. It only reminded them to check—once.
Let’s talk about the implicit conflict of interest. The checklist is co-authored by a payment gateway (NOWPayments) and a security firm (BlockSec). It’s a marketing engine disguised as an educational tool. The logical next step for a company that completes the checklist is to ask: "Who can help me implement these controls?" And the answer conveniently points to BlockSec for monitoring and NOWPayments for gateway services. The checklist is the bait; the subscription is the hook.
Skepticism is the only safe yield.
Now, a deeper insight: the checklist replicates the same pattern we see in security audits. You pay for a report, you fix the findings, you feel safe. But the real vulnerabilities are the assumptions you never questioned. The checklist assumes that the team can execute the controls. It assumes that key management is a series of checkboxes rather than a cultural discipline. It assumes that AML/CFT compliance can be solved by a few technical steps, ignoring the fact that regulatory bodies change rules faster than code can be updated.
I’ve seen projects pride themselves on their "perfect" audit report. Then they stored the private key on a Google Doc shared with the entire team. The checklist wouldn’t catch that because it asks "Do you have a key management policy?" not "Is your key management policy actually followed?"
Contrarian
Here is the counter-intuitive truth: this checklist, and others like it, may reduce security in the long run. By providing a one-size-fits-all framework, it standardizes defenses. Attackers love standardization. They can study the checklist, know exactly what controls exist, and find the gaps the checklist didn’t cover. It’s the security theater of the digital age.
The checklist also creates a false sense of completeness. A team that ticks all 25 boxes feels they’ve done their due diligence. They stop thinking about edge cases. They stop questioning their own infrastructure. Security becomes a compliance exercise, not a mindset.
Trust is not a variable you can optimize away.
And let’s not ignore the temporal nature of this list. Blockchain updates, new cross-chain bridges, and evolving regulation will outdate it within months. The original documentation is already a year old in a space that moves in weeks. The value of the checklist decays faster than the paper it’s printed on.
Takeaway
What should you do? Use the checklist as a conversation starter, not a finish line. Automate every control that can be automated. Key rotation, transaction monitoring, and fee limits should be handled by smart contracts or infrastructure tools, not by humans ticking boxes. The next major exploit won’t be a missing checklist item. It will be the assumption that the checklist was enough.
Dissect. Don’t defend.
Expect to see similar checklists from other security firms in coming months. The real competitive advantage will not be the list itself, but the ecosystem of automated enforcement that sits behind it. If NOWPayments and BlockSec can integrate the checklist into their monitoring suite—making it a living document that alerts you when a control drifts—then the value becomes real. Otherwise, it’s just another PDF for the compliance folder.
The industry needs more than a checklist. It needs a paradigm shift from reactive compliance to proactive, automated defense. Trust is not a variable you can optimize away. It’s earned through continuous vigilance, not quarterly reviews.
"Code executes. Intent diverges." — but only if you let it.