Securing Coinbase’s Edge Payments Infrastructure
summary
Coins move through brittle rails: concrete examples include ACH routing+account only auth that lets anyone with numbers initiate pulls, NACHA files that are manually fixed, and race conditions in SFTP-based reconciliation that double‑process or drop transactions. Controls applied are vendor reviews, threat models, automated unit/integration tests for open redirects and CT log checks, IP whitelisting and GPG for file transfer, higher bug bounty payouts for payment exploits, and monitoring same‑day ACH and 3DS flows to catch logic and timing errors.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:46Secure and Payments
- 4:10KYC AML Privacy
- 6:57CTR vs SAR
- 10:16Payment Networks
- 10:42Fundamental Rules
- 12:16Pull Payments
- 17:36ACH Fraud
- 19:39Why Accept ACH
- 22:11OAuth
- 24:25Push Payments
- 26:08Threat Model
- 32:44Money Bag Flow
- 37:23Application Tools
- 45:06Outro
related talks
26mSecurity Without Friction
51mThe Tie That Binds: Unique Cyber Tools in the Payments Industry
30mGuarding Against Protocol Subversion at Coinbase
19mBuilding safe Payment Infrastructure for the autonomous economy
53mFuture Banks Live in The Cloud: Building a Usable Cloud with Uncompromising Security
32mSecurity horror stories in payments
48mScaling a cryptocurrency exchange using Data Science & Machine learning
30mScaling crypto payments for gaming volumes