A free checklist is not a firewall.
On July 27, 2026, BlockSec and NOWPayments dropped a 25-item security checklist. Nine domains. Zero on-chain execution. It’s a document. Not a tool. Not an audit. Not a monitoring system. Just a list of things to think about—if you have time.
I’ve seen this play before. In 2017, I spent 40 hours decompiling Golem smart contracts. I found three integer overflow vulnerabilities in their token distribution logic. Their whitepaper was full of promises. The bytecode told a different story. That taught me one thing: documentation is not security.
This checklist is documentation. And in a bear market where every protocol is bleeding liquidity, offering merchants a PDF instead of automated safeguards is not just naive—it’s dangerous.
Let’s tear this thing apart.
Context: What Actually Got Announced
NOWPayments is a payment gateway that supports 350+ cryptocurrencies and 30+ stablecoins. BlockSec is a security firm providing real-time monitoring and audits. Together, they released a compliance checklist covering private key safety, smart contract security, transaction verification, DNS, AML/CFT, and stablecoin freeze risk. Twenty-five control items. Free to download.
Andy Zhou, BlockSec co-founder and a Chinese University professor, said the goal is to "turn broad security principles into actionable checkpoints." The checklist is meant to be a shared record used by engineering, compliance, and operations teams. It targets merchants, SaaS companies, games, and iGaming operators.
Sounds responsible. But peel back the layers.
Core: Why This Checklist Fails the Security Test
First, it has no code. A security checklist without automated enforcement is like a fire evacuation plan with no alarms. You can check all the boxes, but if your private key management is still weak, you’re one phishing email away from a drained treasury. Code does not lie; auditors do. The checklist relies entirely on the assumption that the user will implement each control correctly. That assumption is broken before the PDF is downloaded.
Second, conflicts of interest are embedded in the narrative. BlockSec sells security audits and monitoring. NOWPayments sells payment processing. The checklist is a lead generation funnel. You read it, realize you need help, and call them. That’s not security; that’s marketing with a security veneer. I’ve seen this before in the 2021 Bored Ape Yacht Club metadata exploit. I reverse-engineered the smart contract and found the image URLs were hosted on a centralized server with no IPFS backup. A single server outage could kill 10,000 assets. The market panicked. That exploit wasn’t stopped by a checklist—it required infrastructure change.
Third, the checklist lacks automation. Each item is a manual verification point. No on-chain monitoring. No real-time alerts. Silence in the logs is the loudest scream. In my 2020 Compound governance analysis, I simulated a front-running attack and found a 12-second window where slippage protection was absent. A checklist wouldn’t have caught that. You need a mempool watcher and automated response.
Fourth, the checklist is incomplete. It covers AML/CFT but ignores data privacy regulations like GDPR. It discusses stablecoin freeze risk but provides no specific address isolation strategies. It mentions DNS security but doesn’t detail how to secure ENS or other blockchain naming services. Immutability is a promise, not a feature. The checklist treats digital assets as if they exist in a vacuum, ignoring the layered complexity of real-world deployment.
Fifth, it targets the wrong audience. Small merchants with no security team will glance at the checklist and think they’re covered. Large enterprises already have SOC2 or PCI DSS frameworks—they don’t need a 25-item PDF from a payment gateway. The checklist sits in a middle ground that doesn’t protect either side.
I’ve seen the 2022 Terra collapse from the inside. I traced the $40 billion liquidation through wallet clusters. I identified three insider wallets that exited hours before the crash. That wasn’t a checklist failure—it was a structural flaw in the protocol’s economic design. Checklists don’t prevent predatory execution. They just give victims a list of things they should have done.
Contrarian: The Bulls Might Have a Point
To be fair, structured guidance is better than nothing. For a startup accepting crypto payments for the first time, the checklist forces them to think about private keys, transaction verification, and regulatory compliance. Trace the hash, ignore the hype. The checklist is a starting point, not an endpoint.
Andy Zhou’s point about shared responsibility across teams is valid. Security silos are a real problem. A checklist that gets engineering, compliance, and operations on the same page can reduce friction. The nine domains cover the major attack surfaces. If used correctly, it could prevent the most common mistakes—like leaving a hot wallet unmonitored or approving transactions without signature verification.
But that’s a big "if." The checklist doesn’t enforce anything. It’s a shared document. I’ve audited enough projects to know that shared documents gather dust. The only way this works is if the checklist is paired with automated tooling—which neither BlockSec nor NOWPayments provides for free.
Takeaway: Don’t Mistake a PDF for Defense
The release of this checklist is a net positive for the crypto payment ecosystem only if merchants treat it as the first step, not the final solution. Every exploit is a history lesson in slow motion. We’ve learned that the hard way—through Golem, Compound, BAYC, Terra, and dozens of other incidents.
Real security requires continuous monitoring, penetration testing, code audits, and incident response. A checklist cannot replace a block explorer or a triggered reversion. The logic held until the ledger lied.
BlockSec and NOWPayments are not malicious. But they are selling trust in a format that looks like defense. Verify before you trust. And if you’re running a crypto payment system, hire a real security team. Don’t rely on a PDF.
That’s the lesson of 2026. The industry is maturing, but marketing still wears a lab coat. Don’t buy the illusion.