Coldtill Get Coldtill

Coldtill overview

Paste into Claude Code, Codex, Cursor or your favourite coding agent. View Markdown

Coldtill lets a merchant accept crypto payments on their own server, without a payment company in the middle and without the server ever being able to spend the money it receives. The merchant runs the software, customers pay into deposit addresses, and funds are swept to wallets the merchant controls offline. The deposit addresses are smart contracts and program accounts that can only send to the merchant's cold wallet, so the rule is enforced on chain rather than by the server's good behaviour.

The problem it solves

A hosted payment gateway holds your money until it pays you out, can freeze it under its terms, and sees every customer. Running a plain wallet yourself avoids that, but then the server that takes orders also holds the keys, and a single breach empties it.

Coldtill separates the two. The server that faces the internet tracks payments and talks to customers. The money goes to addresses that can only ever pay out to your cold wallet: a hardware wallet or a multisig that never touches the server.

How a payment works

  1. Your shop calls POST /api/v1/payment with a customer ID and a USD amount, and gets back a checkout URL.
  2. The customer opens the hosted checkout, picks a coin and network, and sees a QR code and the exact amount.
  3. The customer pays to their permanent deposit address on that chain. Each customer keeps the same address per chain family, so repeat customers can save it.
  4. Coldtill's watcher sees the transaction, waits for the network's required confirmations, handles reorgs, and updates the payment: OPEN, PARTIALLY_FILLED, FILLED or OVER_FILLED.
  5. Your shop receives a signed webhook and ships the order.
  6. Later, the sweeper moves the funds from deposit addresses to your cold wallet in batches, when the value justifies the gas.

Why the server can't steal the funds

Each chain uses a different mechanism, but the effect is the same: the destination is fixed on-chain before any customer pays, and nothing the server does can change it.

Chain Deposit address Who can move funds, and where to
EVM (Ethereum, Base, Polygon, BNB Chain) A CREATE2 contract address computed from your factory Anyone can trigger a sweep, but the contract can only send to the cold wallet written into the factory when you deployed it from your own wallet
Tron A CREATE2 contract address computed from your Tron factory The same as EVM: anyone can trigger a sweep, but only to the cold wallet fixed in your factory
Solana A program-derived address (PDA) of the Coldtill deposit program Anyone can trigger a sweep, but the program only sends to the treasury fixed in your config account, which your wallet created
Bitcoin An address derived from your xpub (watch-only) Only you, with the private key that never leaves your wallet. Coldtill never sweeps Bitcoin

The only private keys on the server are hot wallets. They pay gas for sweeps and send payouts you approve. They are encrypted with age under a passphrase, and only the two processes that sign (sweeper and payouts) can unlock them. Keep their balance small: the worst case is losing that float.

What it supports

  • Chains: Ethereum, Base, Polygon and BNB Chain (native coin, USDC, USDT); Tron (TRX and USDT, with USDC available but off by default); Solana (SOL, USDC, USDT); Bitcoin (watch-only). Each install runs on testnets or mainnets.
  • Projects: one install serves one merchant with any number of projects (shops). Each project has its own deposit wallets, API keys, webhooks, branding, sweep settings and payout limits.
  • Hosted checkout with a QR code, confirmation progress and your branding: logo, colours, light or dark theme, a message, support links and a return button.
  • Webhooks signed with HMAC-SHA256, with timestamps for replay protection and a long retry schedule for final events.
  • Payouts from the hot wallet with an address book, limits, two-factor plus emailed-code approval, and idempotency keys.
  • Auto-convert (optional): customers pay in BTC, ETH, SOL and other coins, and a swap provider (NEAR Intents 1Click, or THORChain) delivers USDC or USDT straight to your cold wallet.
  • Integrations: a TypeScript SDK and a WooCommerce plugin.

What it deliberately doesn't do

  • Custody for others. One install is one merchant. There is no multi-tenant "operator" mode.
  • Fiat. There is no off-ramp; auto-convert settles in stablecoins.
  • Refunds from deposit addresses. Refunds are payouts from the hot wallet, which you approve.
  • Trust a swap provider's word. A conversion is only credited when Coldtill's own nodes see the stablecoin arrive in your cold wallet.

Where to go next