Eight payment and wallet incidents expose hidden risks

The findings, reported on October 25, 2026, include software defects that could cause rejected payments, unprotected swap execution and wallet-data loss, alongside confirmed banking and mobile-money disruptions across Mexico, Africa and Indonesia.

Although the incidents are unrelated, they illustrate how failures in financial infrastructure can affect users even without a successful cyberattack or theft of funds.

PayPay and x402 Face Payment Authentication Problems

PayPay’s Java Open Payment API SDK contains a reported concurrency defect that can cause one payment request to receive authentication information belonging to another.

The issue, disclosed in GitHub report #244, affects SDK version 1.0.9. The SDK reuses a mutable HMAC authentication object that stores transaction details before creating authorization headers.

When two requests use the same configured client simultaneously, the second can overwrite the first request’s signing information.

A deterministic test reproduced the problem, showing that the first request received the second request’s body hash. PayPay should reject the resulting signature because it does not match the actual transaction.

The reporter proposed isolating signing data by thread and said all 57 tests passed after the correction. The finding does not establish that PayPay accepted unauthorized transactions or that customer funds were stolen.

A separate defect in the x402 cryptocurrency payment protocol affects how Go facilitator implementations classify invalid payments.

According to issue #3937, ten example and end-to-end handlers return HTTP 500 errors for ordinary verification failures, including invalid signatures, insufficient balances and expired authorizations.

Instead of receiving a structured response identifying the invalid payment, resource servers encounter what appears to be an infrastructure failure.

Payments are still rejected, but automated applications can lose the information needed to distinguish customer mistakes from temporary service disruptions.

A corrective pull request, #3938, was submitted on October 25 and remained open during verification.

Paraloom, Vultisig and Monero Reveal Wallet Risks

Paraloom faces a potentially more direct trading concern after a security researcher reported that its private-swap functionality accepts slippage limits without passing them to the transaction router.

The medium-severity report identifies a default tolerance of 100 basis points, equivalent to 1%, but finds that the parameter disappears before the routing request.

The wallet’s approval interface also fails to display the tolerance, while its execution path does not independently enforce a minimum output amount.

The reporter reproduced the missing parameter using an execution harness and identified the same behavior in the 1.7.14 code lineage.

Consequently, users could receive worse execution prices than their selected tolerance implies, although realized financial losses have not been established. A proposed fix was submitted but remained unmerged during verification.

Vultisig’s Android wallet faces a separate issue involving liquidity deposits on THORChain.

An October 25 report describes how the application can use an incorrect paired-asset address when adding RUNE to an existing liquidity position.

THORChain rejects transactions when the supplied address conflicts with its recorded liquidity-provider information. Although the assets are refunded, users can lose network fees and repeat unsuccessful signing operations.

The reporter’s live-network assessment identified 87 RUNE-only positions among 223 ETH.USDT liquidity records, alongside 14 of 27 ETH.WBTC positions and 480 of 1,086 ETH.THOR positions.

Those figures establish that the relevant position configurations exist, not that every position has suffered a failed transaction.

Meanwhile, an automated Monero security review found that a proposed wallet-recovery fix leaves certain cache-overwriting scenarios unresolved.

A failed wallet-creation object can retain an existing wallet’s file path. Subsequent operations may allow that object to overwrite locally stored information, including transaction keys, notes and address-book records.

The review classified the findings as low severity. Private-key files and funds are not shown to be compromised, and exploitation requires specific behavior by an application integrating Monero’s wallet library.

Payment Outages Hit Mexico, Africa and Indonesia

Beyond software vulnerabilities, three payment providers reported operational incidents affecting banking and mobile-money services.

Nasdaq-listed dLocal disclosed another BBVA Bancomer processing interruption in Mexico, beginning at 02:11 GMT-3 on October 25 and resolving 17 minutes later.

The incident continues an unusual pattern of similar disruptions beginning around 02:10 on October 6, 7, 12 and 18.

The repeated timing raises questions about scheduled processing or recurring integration problems, although neither dLocal nor BBVA has confirmed a technical cause.

In Africa, PawaPay experienced a particularly unstable recovery involving Orange Cameroon.

An earlier incident was declared resolved at 06:46 UTC, but another outage was opened only 50 minutes later. Although the service briefly entered monitoring, PawaPay subsequently confirmed that its deposit gateway remained unavailable, including in an update at 13:37 UTC.

Separate October 25 disruptions affected DRC Orange and Tanzania Vodacom. DRC Orange was subsequently marked resolved, while Tanzania Vodacom had reached monitoring by the latest reviewed update.

The repeated Cameroon difficulties are particularly concerning because a declaration of recovery was followed almost immediately by another service failure.

Indonesia’s Xendit reported a different problem involving transfers to Bank Syariah Indonesia.

The interruption, lasting from 08:10 to 09:40 Western Indonesian Time, affected payouts, disbursements, remittances and escrow transactions within two disconnected amount ranges: IDR 1–9,999 and IDR 100,000,001–250,000,000.

Notably, the much larger middle range of IDR 10,000 to 100,000,000 was not identified as affected.

That unusual segmentation suggests the possibility of separate processing routes or transaction tiers, although Xendit attributed the disruption to a partner-system problem without identifying the underlying mechanism.

Why These Failures Matter for Investors

The significance of these incidents extends beyond their immediate operational impact. Together, they expose an important weakness in modern financial services: protecting funds against unauthorized access does not guarantee that transactions execute correctly or that financial records remain intact.

PayPay and x402 demonstrate how authentication and error-handling defects can disrupt legitimate payments without bypassing security controls. As automated payments become more widespread, distinguishing invalid transactions from infrastructure outages will become increasingly important.

For merchants, inaccurate failure classifications can generate unnecessary retries, complicate reconciliation and undermine customer confidence.

Paraloom highlights a more immediate financial concern. Slippage protection is fundamental to cryptocurrency trading because execution prices can move between quotation and settlement. A tolerance that is accepted but never enforced leaves traders exposed to adverse execution conditions.

Vultisig illustrates how protocol-level safeguards can successfully prevent incorrect transactions while still imposing costs on users through network fees. Monero’s findings show that safeguarding private keys does not automatically protect the transaction records needed for accounting and wallet management.

The operational incidents carry a different message for investors.

For dLocal, recurring disruptions involving a recognizable banking partner deserve attention because payment-processing consistency is central to merchant relationships. However, there is no disclosed evidence that the latest interruption materially affected company revenue.

PawaPay’s repeated Cameroon Orange failures raise questions about recovery stability, while Xendit’s amount-specific disruption suggests that payment availability may depend on transaction characteristics rather than simply whether a bank is online.

These developments reinforce the competitive value of reliable payment infrastructure. Providers capable of reducing failed transactions, preserving accurate error information and maintaining dependable partner connections may have an advantage as merchants become more sensitive to operational interruptions.

The next important developments will be confirmed software fixes, evidence that those corrections reach production systems, and explanations for recurring processor outages.

For investors and customers alike, the central issue is whether financial platforms can consistently deliver the transactions they promise—not merely whether they can prevent unauthorized ones.