CoinPayments
Closing a Security Gap That Put 2 Million Users at Risk
How Path Network fixed a critical flaw in CoinPayments' DDoS defense, the world's largest multi-cryptocurrency payment platform, before it could cause another outage.
2M+
Users protected
182
Countries served
client
CoinPayments is a multi-cryptocurrency payment platform serving over 2 million users across 182 countries.
Service
Location
NY, USA
industry
Crypto Payments
“The CoinPayments team is extremely grateful, as the help from Path has changed our entire security outlook. Anxiety regarding the next problem to now knowing the Path team is protecting our company.”
— Jason Butcher CEO CoinPayments
Overview
The World's Largest Multi-Cryptocurrency Platform
Global scale
CoinPayments is a digital currency payment platform serving more than 2,000,000 users across 182 countries, the most comprehensive multi-cryptocurrency platform in the world.
A prime target
That scale, and its affiliations with major platforms like Shopify, has made CoinPayments a prime target for network attacks.
The vulnerability
CoinPayments' own security check couldn't tell attack traffic from its API. The system built to stop bots ended up blocking CoinPayments instead.
JavaScript Challenge
Root cause
CoinPayments API
Target
Days
Downtime
Shopify + vendors
Impact
What Happened
CoinPayments' previous provider tunneled encrypted traffic through its DDoS mitigation without inspecting it, relying on network capacity to absorb attacks. Its main safeguard was a JavaScript challenge, a test to tell real browsers apart from attack scripts.
The attack targeted the CoinPayments API directly, and the API had no way to complete a browser-only challenge either. The system built to stop bots ended up blocking CoinPayments' own legitimate traffic.
Every vendor connected through that API, including Shopify, lost access, irregular or completely down for days.
The fix
Path's Emergency Response Team fixed it with granular filtering and packet analysis, telling real attack traffic apart from CoinPayments' own legitimate traffic instead of relying on a blunt browser test.
"It was a real honor to have the opportunity to serve Coinpayments.net and carry their traffic on our network. Jason's qualified team genuinely cares about their clients having the best quality of service possible. It was very apparent during our deployment."
