Payment processors Xendit, PawaPay and Paystack reported disruptions across Indonesia, the Philippines and Africa on November 4, 2026, affecting QR-code payment confirmations, e-wallet payouts, mobile-money transfers and Mastercard preauthorizations. In today’s payment and security roundup, Xendit recorded two Indonesian QR payment incidents and two consecutive GCash payout interruptions, PawaPay reported more than six hours of Orange Sierra Leone disruption, and Paystack investigated failed Mastercard preauthorizations in South Africa. Separately, crypto security organization Security Alliance disclosed 99 incidents handled during the preceding week, including more than $57 million in reported protocol-compromise losses.
The payment incidents were documented through official provider status records, while the security figures came from Security Alliance’s weekly investigations. There is no evidence of a common technical cause connecting the payment disruptions, and the affected processors did not disclose comprehensive transaction volumes or confirmed financial losses.
Xendit records repeated QR payment failures in Indonesia
Xendit experienced two consecutive disruptions affecting its Indonesian QR-code payment channel on November 4, with merchants warned that transactions could be initiated successfully even when subsequent payment confirmations were delayed.
The first incident was identified at 11:57 Western Indonesian Time (WIB) and marked resolved at 11:58. A second notice appeared at 12:13 WIB, just 15 minutes after the first resolution, and remained active until 12:32.
Both incidents carried the same operational description. Xendit attributed the disruption to a payment partner and reported that successful-payment rates had fallen below normal thresholds.
Merchants could still initiate QR-code payment transactions, but callbacks confirming their completion were subject to delays. A transaction being created successfully did not establish that the customer’s payment had subsequently completed.
Two notices, the same QR channel, and little detail about what had failed.
Xendit advised merchants to direct customers toward alternative e-wallet providers and reconcile the status of transactions initiated during the incidents. The instruction was particularly relevent to payment requests that had been created but had not yet returned a conclusive success or failure notification.
The incident resembles the earlier Xendit and Mercado Pago payment-notification disruptions reported on November 1 and 2, when delayed confirmations created a gap between payment processing and the information available to merchants.
For merchants using QR-code payments in automated checkout systems, an unresolved confirmation can prevent an order from advancing to fulfillment even when a customer believes payment has been completed. Conversely, requesting another payment before checking the original transaction’s final status introduces the possibility of duplicate payment attempts.
Xendit did not report actual duplicate charges, identify the affected partner or quantify the transactions requiring reconciliation. The published records confirm two short interruptions rather than continuous QR payment unavailability throughout the period between 11:57 and 12:32 WIB.
Xendit’s GCash payout channel fails twice in 30 minutes
Later on November 4, Xendit reported two additional incidents affecting payouts to GCash destinations in the Philippines, both attributed to system problems involving a payment partner.
The first interruption began at 23:10 WIB and was resolved at 23:20. The second began at 23:30 WIB and was marked resolved at 23:40, creating two recorded ten-minute incidents separated by a ten-minute recovery interval.
Both notices identified the PH_GCASH channel and transfers ranging from PHP 1 to PHP 50,000. The affected services included payout and disbursement processing, with Xendit’s incident classifications also identifying remittance payouts.
Ten minutes of disruption, a short recovery, then ten more.
The repeated failure is distinct from the previous GCash payment disruptions recorded through Xendit on October 29 and 30. Those incidents affected incoming e-wallet payments and included repeated transaction-creation errors followed by delayed completion callbacks. The November 4 incidents instead concerned outgoing transfers to GCash destinations.
For businesses that use GCash as a disbursement destination, the repeated interruptions could have delayed transfers to beneficiaries or required transaction-status checks before retrying unsuccessful requests. The operational exposure differs from a checkout failure because the merchant is sending funds rather than collecting them.
The notices did not identify the payment partner, disclose affected payout volumes or confirm whether transfers submitted during the first interruption remained pending when the second began.
Xendit attributed both incidents to partner-side issues but did not provide a root-cause explanation establishing whether the second failure resulted from an incomplete fix to the first. Nor do the notices establish a GCash-wide outage affecting transactions outside Xendit’s processing channel.
PawaPay and Paystack report targeted African payment outages
PawaPay documented an interruption lasting approximately six hours and 38 minutes on November 4, affecting both incoming deposits and outgoing payouts through Orange Sierra Leone.
The provider began investigating degraded Orange services at 08:53 UTC. At 09:33, it confirmed that both the Orange Web Deposit and Payout gateways were experiencing an outage and said the issue had been escalated to the mobile-money operator.
At 11:34 UTC, PawaPay reported improving transaction success rates and moved the incident into monitoring. Final resolution was published at 15:31 UTC.
Six hours and 38 minutes on the incident record, with both sides of the payment flow affected.
The combined impact on deposits and payouts is more extensive than an interruption confined to one transaction direction. Businesses relying on PawaPay’s Orange Sierra Leone integration faced potential disruption to receiving customer funds and distributing payments to recipients through the same mobile-money channel.
The incident follows previous PawaPay disruptions involving African mobile-money operators, including Orange services in the Democratic Republic of Congo and other regional payment providers in late October.
PawaPay’s November 4 notices identify the affected operator but do not disclose whether Orange’s underlying mobile-money platform was unavailable to all users or whether the issue was limited to the integration serving PawaPay customers.
The provider also did not disclose the number of deposits or payouts delayed, the value of transactions affected or whether any pending transfers required manual reconsiliation after the reported recovery.
Separately, Paystack experienced a Mastercard preauthorization disruption in South Africa on November 4, with its official status record identifying the issue at 08:57 UTC.
Paystack said an issue affecting Mastercard preauthorization transactions had been identified and that a fix was being developed. At 10:22 UTC, the company reported implementing the fix and began monitoring the results. The incident was marked resolved at 10:36 UTC, approximately one hour and 39 minutes after the initial notice.
Preauthorization allows a merchant to obtain approval for a card transaction and reserve funds before a final charge is captured. It is used in payment arrangements where the merchant needs authorization before the exact transaction is completed or settled.
Cards were not all down. It was the preauthorization function.
The reported failure could have affected businesses depending on authorization holds, including merchants collecting deposits or using delayed-capture payment arrangements. Paystack did not disclose whether particular reservations, deposits or merchant transactions were rejected.
The status record also does not identify an affected issuing bank, acquiring partner or specific technical failure. It establishes an issue affecting Mastercard preauthorizations processed through Paystack in South Africa, not a nationwide Mastercard outage or an interruption to every form of card payment.
Security Alliance records 99 crypto incidents and $57M in losses
Security Alliance (SEAL) published its weekly security statistics on November 4, reporting that its incident-response operation had triaged 99 incidents between October 28 and November 3.
The total was higher than the 73 incidents reported in its preceding weekly review. SEAL’s figures reflect cases and reports handled by its own operation, rather than a comprehensive count of attacks across the global cryptocurrency industry.
According to the organization’s November 4 weekly security report, nine protocol-compromise cases accounted for approximately $57.2 million plus 2.42 BTC in reported losses, excluding Binance’s previously disclosed security incident.
One exchange hot-wallet theft represented approximately $49 million of the dollar-denominated protocol-compromise total. SEAL said the root cause of that incident remained undisclosed and that its team had assisted with on-chain tracing and asset-freezing coordination.
The remaining cases included a $5 million signing-infrastructure theft, a $1.15 million vault exploit on TON, a $1 million lending-protocol bug, an $805,000 bridge exploit and a margin-protocol incident involving $236,000 plus 2.42 BTC.
SEAL separately classified $3.62 million plus 0.91 BTC in seed compromises, $3 million in North Korean intrusion-related losses, $2.19 million in infrastructure exploits, and $1.57 million plus 1.12 BTC associated with fake support callers.
Its other reported categories included $630,000 in malware-related losses and $332,000 connected to pig-butchering scams.
The organization also reported collecting 5,137 phishing domains, publishing 5,185 indicators of compromise and identifying 169 cryptocurrency wallet addresses during the week.
One week’s intake, and still an incomplete picture of losses across the market.
The incident classifications should not be interpreted as a single independently verified global loss total. They describe SEAL’s own caseload and may include investigations at different stages of confirmation. The separately reported cryptocurrency amounts also cannot be converted into one definitive dollar figure without specifying valuation dates and prices.
More than 10% of incoming reports involved the Binance attack, including tracing requests, attacker addresses submitted for freezing and third-party intelligence. Those reports were counted in SEAL’s intake even though the losses associated with Binance were excluded from its $57 million-plus protocol-compromise category.
The report includes several operational findings beyond the headline loss figures. SEAL described a multimillion-dollar infrastructure compromise in which an attacker executed code inside transaction-signing containers and used their cloud permissions to decrypt stored keys. The organization said shutting down the affected system had failed to prevent the theft.
Another case involved an attacker making more than one million guesses against six-digit two-factor authentication codes while spoofing client IP headers to evade rate limits. The attacker subsequently created API keys and initiated withdrawals, with reported losses of $56,700.
SEAL also documented four North Korean intrusion cases with approximately $3 million in reported losses. Three incidents attributed to the UNC1069 threat cluster involved macOS compromises, with attackers remaining undetected for weeks or months before draining funds.
The findings extend beyond smart-contract vulnerabilities. Compromised credentials, cloud permissions, signing infrastructure, malicious websites and impersonation attacks all featured in the week’s reported cases.
SEAL recorded seven infrastructure-exploit reports involving $2.19 million in losses, including compromised cloud credentials and trading-bot keys. These cases did not depend on exploitable smart-contract code, according to the organization’s classification.
The payment outages reported by Xendit, PawaPay and Paystack are seperate operational incidents and should not be counted as part of SEAL’s crypto-security losses without evidence of a connection.
For payment providers, the outstanding information concerns unresolved transaction states, partner dependencies and the value of payments delayed during incidents. For cryptocurrency operators, SEAL’s findings identify particular areas of exposure in infrastructure and credential security. Neither set of disclosures establishes losses beyond those explicitly reported, and the extent of the disruptions remains dependent on further incident-level information.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574