Don’t let billing map where projects run
Projects pay in USDC. Nobody can see which ones run on you.
What a billing address leaks
All of it is readable from one public address, by anyone, for as long as the chain exists.
-
Who runs on you
Named projects and their plans.
-
Where they run
Narrows the search for attackers.
-
Expansion
Upgrades show before announcements.
-
Biggest accounts
Easy to find, easy to poach.
How an attacker maps targets
- block explorer
- → hosting billing address
- protocol-x.eth 1,200 USDC
01 Follow the billing address.
- attacker’s notes
- Protocol X → this provider
- new region this week
02 Now they know where it runs.
- target list
- provider: known
- regions: known
- next: probe infra
03 The search just got smaller.
How it works
- Payment request Created
- ref
- invoice H-118
- amount
- 1,200.00 USDC
01
Invoice or top-up
Billing creates a request
- Payment request Paid
- ref
- invoice H-118
- amount
- 1,200.00 USDC
- from
- customer wallet
02
Project pays
From its treasury
- Payment request Shielded
- ref
- invoice H-118
- amount
- 1,200.00 USDC
- from
- customer wallet
- to
- hidden
03
Shielded on arrival
Fresh address, every time
- Payment request Confirmed
- ref
- invoice H-118
- amount
- 1,200.00 USDC
- from
- customer wallet
- to
- hidden
04
Service provisioned
Matched by reference
- No customer account
- Hosted checkout
- USDC + USDT on Arbitrum
- From $0.50
But what about…
-
Refunds
A new payment back to the customer, from your own process.
-
Tax and accounting
Your accountant reads every payment with the viewing key.
-
Compliance
Incoming funds are screened before they’re shielded.
-
Custody
You hold the keys. Curvy can’t move your funds.
-
Chargebacks
None. Onchain payments are final.
-
Customers without USDC
Keep your other methods. This is one more option.
Who sees what
The payer’s own transfer is always public.
| who | The payment | That they use you | Their plan |
|---|---|---|---|
| The public | Can see | Hidden | Hidden |
| You | Can see | Can see | Can see |
| Your accountant | Can see | Only if you share your viewing key | Only if you share your viewing key |
Is it right for you?
Good fit if
- Your customers pay, or ask to pay, in USDC or USDT
- Your revenue or customer list is sensitive
- You’re happy to receive stablecoins, not fiat
- You can add a server-side call to checkout
Not yet if
- You need fiat paid into your bank automatically
- You need chains other than Arbitrum
- Your customers pay in Bitcoin or other coins
- You need a no-code store plugin today
Built to be checked
Private, not unaccountable. How the compliance model works
Questions
Can customers top up credit?
Yes. Create a payment request for each top-up. Your backend confirms it by reference and adds the credit.
How do renewals work?
Each renewal is its own payment request, created by your billing system when it’s due.
Is the customer’s payment hidden?
No. Their transfer is public. Nobody can tell it went to you.
Which stablecoins are supported?
USDC and USDT, settled on Arbitrum. Fees are taken from the payment.