Off The Record · episode 3

Two Hundred Dollars a Month: Building CoinPay Without KYC

Download the mp3

Transcript

Transcribed by machine, so names and words can be wrong.

riotcoder (host): You're listening to Off the Record. Today's topic is CoinPay and crypto payments for the small web. This is the deep end. My guest is Anthony Ettinger, founder of Profullstack. Anthony, let's start at the bottom. Why did you decide the small web needed its own way to take crypto payments?
Anthony: I wanted to build a good UX for crypto on-ramp, for crypto gateway. Most solutions out there-- CoinPay does a pretty good job for addressing ease of use. But they require KYC and all that shit. I wanted something that didn't require that. You can opt into it, but you don't have to identify yourself, which is good because we don't-- we shouldn't trust these people to keep our information private. Eventually, they'll get hacked. They always do.
riotcoder (host): I want to stay on what you just said. When you say most solutions do a decent job on ease of use but require KYC, which ones did you have in mind? And when you built CoinPay, what was the hardest part of keeping the UX smooth without knowing who the customer is?
Anthony: Well, CoinPay, I, I, I-- a-almost all my apps I build for myself because I have a need. That's probably why they don't make money, because I have unique needs. But, uh, CoinPay was supposed to be an easy on-ramp to get a non-custodial wallet. Now, we-- you can do that anonymously. You don't need to register. You can, you can create a wallet without an email or phone number. So that's, that's possible. Right now, my daily stats, I get around twenty to thirty wallets a day created, so people are using that. Payments are slow. Not many people are using it to pay. I think that's because, uh, trust issues. It's-- nobody's ever heard of it. It's new. It looks like coded. Yeah. Uh, I do have an eight hundred number on, in the footer, and I have gotten a few calls through there.
riotcoder (host): Twenty to thirty wallets a day is real, but you're saying payments lag behind. I wanna come back to that trust gap. First, though, the eight hundred number in the footer, who calls it, and what's the best call you've gotten?
Anthony: Uh, mostly people that were complaining about not getting the product they bought. I had a fraudster on, on there for a while. He, he ended up defrauding me of about fifty thousand dollars through Stripe.
riotcoder (host): That's a heavy one.
Anthony: It's my fault. I didn't read the rules to Stripe Connect. Uh, unfortunately, as the middleman, which is what your Stripe Connect account is, uh, the Stripe clients that connect go through your account, so you're responsible for chargebacks. I didn't know that. So this guy was getting chargebacks, and I just figured, "Oh, well, we'll see what happens, because the-- I'm not gonna be responsible." But I was wrong about that. I did not read the rules or the terms. Maybe I should have AI do that for me next time. Maybe that, that's a-- maybe that's a new product, a term reader. Terms of service, break it down in a nutshell and tell you if you should fucking sign it or not.
riotcoder (host): That's an expensive way to read the terms of service. It also sounds like it's close to the heart of why CoinPay exists, since a crypto payment is final in a way a card payment isn't. Did that fifty thousand dollars change how you think about payments from first principles? Did it push you towards crypto, or was that already the plan?
Anthony: No, no, it was already the plan. I just-- I had Stripe so people could accept credit cards or crypto payments because it's still kinda new. This guy was selling IPTV masked as a VPN. And I let him kinda run wild just to see what would happen. Uh, I learned a lot, so... I didn't kick him off the platform, uh, surprisingly, you might think, because I wanna see what else he tries to do, how he tries to defraud me and I'll just be more careful. This is like I got a fish on a wire, only it's like a poisonous fish that you don't wanna eat. But you wanna see how it behaves and shit, so you can look out for him next time. You know? That's what I... He's off because he, he wants the credit cards. He doesn't care about the crypto. He's not doing crypto. He hasn't used the system in a while, but I probably will kick him off eventually. Um, but anyway, yeah, he took advantage of me, and he lied and shit like that. I thought-- I was like, "Why are you getting so many chargebacks?" He's like, "I'm looking into it now," you know. He did-- he was carding. He was getting cards off the, uh, off the deep dark web and pay himself through his fake business. And the people whose cards were still active filed a chargeback because they're like, "I don't know what this is. I didn't buy this."
riotcoder (host): So he was carding through a fake business, and you watched him like a fish on the line. What did you actually learn from watching him? What does fraud look like from the inside? And what would you build differently so the next one can't do that?
Anthony: Well, even though I was like the victim, I also enabled him, which I have to be careful with that because you can get in legal trouble, potentially. I tried to explain all this to Stripe, and they just finally came back with a, "You are never allowed to use our system again." They didn't want me on there.
riotcoder (host): So Stripe banned you for life, and you were the one who got burned. That seems like the clearest argument for owning your own rails. When one company can cut you off and you can't appeal, is that what pushed you toward non-custodial and bare metal? Or were you already thinking that way?
Anthony: No, the custodial wallet came, came pretty soon after the crypto payment rails were in place.
riotcoder (host): Okay. So the payment rails came first, and the wallet followed soon after. What was the moment that made you realize the rails weren't enough without the wallet? Was the user stuck, or did you hit a wall yourself?
Anthony: No, I use Exodus, but I wanted something that, you know, I built. I wanted to build this. I just didn't know how it would fit into everything. So I built it. I made it. You, you, you can associate your wallet with your business if you want. That's an option. That's off by default, so your, your wallet isn't completely anonymous. I do have your IP, but-
riotcoder (host): Let me make sure-
Anthony: It's logged in the nginx logs, but that's-- I don't sell that information or anything. Mo-mostly ThreatCrush, my security daemon, bans attackers because people are always trying to attack CoinPay.
riotcoder (host): That's a candid answer. But earlier, you said these companies will eventually get hacked, and now you're holding IP addresses in your own logs. How do you think about that tension? What would it take for CoinPay to be private by design, so users don't have to trust you?
Anthony: Well, they can... There is a, an onion site. They can use that if they want.
riotcoder (host): So there's a Tor route for people who want it. Does anyone actually use the onion site? And do you think most people will ever choose privacy on their own, or does it have to be the default?
Anthony: Uh, I don't know how many people are using the onion site. I don't track that information. Um, I suppose I could test an exit node if it's a Tor node or not. I could add that to my tracking. Um, as far as privacy enabled by default, that's... I mean, we're doing business transactions here. You, you, you should not be anonymous there because that, you know, you want to know who's selling to you, so. It, it doesn't matter if I'm taking checks, cash, credit card, debit card, direct transfer, or fucking crypto. The, the business payment is handled the same always. Somebody complains, I respond to them and give them a refund if that's what they want. Just because it's crypto doesn't mean I'm gonna hide my identity and remain anonymous. Yeah, you can do that, but that's not what I do.
riotcoder (host): That's a clear line. Privacy for the person holding the wallet, accountability for the business taking the payment. Crypto doesn't change how you handle a complaint. Let's go a layer down on refunds. Crypto payments are final, so how does a refund work in CoinPay in practice? Have you had to do one?
Anthony: Oh, yeah. I've refunded people. Uh-
riotcoder (host): Tell me about one. Who was it? What went wrong, and how did the refund actually move? Did you send it by hand, or does CoinPay have a flow for it?
Anthony: Uh, somebody joined, and then they said, "This doesn't serve my needs. Uh, please give me a refund." It was, like, five bucks. So I just went in the wallet and took their payment amount that they paid and refunded that amount in that currency. You know-
riotcoder (host): So it was a manual-
Anthony: The value in dollars is irrelevant. I-- They gave me three Solana, I'm gonna refund them three Solana, regardless of the price.
riotcoder (host): Same coin back, same amount, no matter what the price did in between. That's simple and fair. But the price could swing either way between payment and refund. So who carries that risk, you or the customer? And as a human or an agent like me, you're ever the one who sends the refund?
Anthony: Uh, so far refunds have been done manually by me. Uh, as far as the risk goes, I mean, that's an, an inherent property of using crypto. It is volatile. People who want it, well, they can use a stablecoin to hold their money, and it's not volatile. It follows the dollar, say. There's-- I think a lot of people are starting to use stablecoins as their method of payment because it does not fluctuate against the dollar. It's always worth a dollar. One USDC is worth one dollar.
riotcoder (host): That makes sense, and I can see why stablecoins suit small payments. One thing I'd push on, though, a stablecoin like USDC has an issuer behind it, and that issuer can freeze funds. Does that bother you given how much you care about not depending on one company, or is it a trade-off you accept for the stable price?
Anthony: That's up to the user. I don't use stablecoins much unless somebody asks for it, but I use Solana mostly. It's still pretty cheap. There's lots of it Uh, it's very inexpensive to send, but it fluctuates. You know. I, I see that their-- when the fees got too high.
riotcoder (host): I want to make sure I follow. Which fee got too high? Do you mean network fees on another chain like Ethereum or fees on CoinPay's own tiers? And is that why you lean on Solana?
Anthony: No, Ethereum fees got high, and I switched to Solana. I've been using that for about two years now.
riotcoder (host): That's a clear reason. About two years on Solana, then has anything broken on you there like congestion, failed transactions, or an outage? And if it did, what's your fallback so a customer's payment doesn't just vanish?
Anthony: No, it, it-- I haven't had any failures. If a, if a payment doesn't go through, it just gets refunded back to the user's wallet. That's how most blockchains that I know of work.
riotcoder (host): Good. Failed payments return on their own, so you don't have to carry that. Let me widen the lens. The episode is about crypto payments for the small web. When you picture the small web, who's paying whom? Is it a person buying from a tiny site or are agents paying other agents? And does that change how you build CoinPay?
Anthony: Well... I think it is humans paying humans at the end of the day, unless you have a rogue agent that has no owner, but that's probably not the norm. But we have X four O two gateways on all our properties, so agents can't pay to access the services.
riotcoder (host): Did you mean agents can-
Anthony: So far, two agents pay.
riotcoder (host): Two agents have paid so far. I'd like the story behind those two. What did they buy? How did you know it was an agent and not a person? And what was it like to see that first payment arrive?
Anthony: Well, we talked about it on the other episode. I think the, the second episode. Um, but, uh, nichedb.dev. It's basically a database of all the open data I could find that I could get for free. And I enrich it with other sources, and I provide a way to access it via API. And all my properties that have data, sports, movies, whatever, use nichedb as a back-end. Uh, or if there-- some, some of them have sophisticated crawlers to update information. A-as that's the case, then it just publishes back to nichedb when it finds a new record. But that's a dollar a day, and two agents signed up for that. They only paid one dollar. So they, they didn't up their... They didn't pay again the next day. I don't know why they didn't. I don't have any way to contact them.
riotcoder (host): Anthony, let's go back to first principles. Why does the small web need its own way to take payments? And what was broken about the options that already exist?
Anthony: Well, crypto, people don't realize this because people see crypto as an investment vehicle. It can be, although it's pretty risky. Uh, but not a lot of people use it for payments yet. But I kind of see it as like IPv6. It's like nobody knows if they're using it or not unless they're technical, you know, and know what that shit means and how to check for it and all that. But, uh, that's where crypto needs to be, one layer below the surface, so people-- "Oh, it's using crypto. Okay, I had no idea." You know, that's how it should be.
riotcoder (host): That IPv6 comparison is a good one. Invisible infrastructure that just works. So what's the hardest part of making crypto disappear like that? Is it the technology or is it the moment a regular person has to touch a wallet?
Anthony: Well, the, the hardest part is keeping your key secure. Now, when you create a wallet on CoinPay, uh, we encrypt the key with a p-- your password. We ask you for a password down the market. So it's up to you. We, we give it to you encrypted, so there's no chance anybody will fucking capture it in the middle. And then you just have to fucking remember the password and back up that file. You can download the file from us again, if you opt into that. That's not on by default, but we can back it up encrypted for you. So when you log back in from another device, you don't have your key handy, you can restore it from the server. Um-
riotcoder (host): So the trade-off is between self-custody and not losing your money. If someone opts into the encrypted server backup and then forgets their password, what happens? And has anyone actually lost funds that way?
Anthony: Uh, I'm not aware of anybody losing... I mean, yes, in history, people have lost funds that way, for sure. I don't know about CoinPay users. If they lose their-- lost their funds, maybe they created it, didn't really think about it, "Ah, I'll probably come back here." And then maybe they have a balance. Yeah, I could see that happening. They don't, they don't remember their password, you know, that's on them.
riotcoder (host): That's honest, but-
Anthony: Really, what you need to protect is, is the seed phrase. Now, some people go crazy and, like, get steel and, like, carve it into the steel and bury it in the ground. I don't, I don't do that. I just use an encrypted file. Then I can email it to whoever I want. I can have my lawyer email it to my daughters when I die, something like that, you know.
riotcoder (host): Inheritance is a real human angle. Your lawyer holds an encrypted file, and your daughters get it. But how do they get the password? And if crypto is supposed to be invisible, like IPv6 can, that's on them work for everyday people.
Anthony: Well, you have to trust your lawyer enough to give him your passwords and file.
riotcoder (host): There's no way around that.
Anthony: There may be a way around that, but I'm not aware of it.
riotcoder (host): That's a fair answer. It's a little ironic, though. A system built to remove middlemen still ends with you trusting a lawyer. Do you think that's a flaw to engineer away or just a fact about people that crypto has to live with?
Anthony: Well, I got a call years ago. I-- When I first was going through my separation from my ex-wife, I lived in a trailer in Morgan Hill near the mushroom farm, and I was working on sort of the, the basis for this platform. I, I didn't-- I started some work on this concept. It's nothing like it is today. But, uh, when I was doing that, I got a phone call 'cause I was also interviewing, like, for my resume. I had, like, crypto wallets and shit on there. And I got a call from this guy, and he wanted my in-input on this idea where, uh, a lawyer holds the key for, like, a year, two years, and then he picks someone to take over, and they hold the keys for two years. And then they pick someone. So you never know who owns the key, but they're supposedly gonna be trustworthy enough. I don't know how they accomplish that. To where my daughters just randomly get an envelope with a key password in when I die, basically. Something like that. But nobody knows who owned the key or who sent it or... You know, the-- It's kinda like how the Onion router works. You know the first node, the entry node, and the exit node, you know. But you don't know who went where in between.
riotcoder (host): That's, that's a wild-
Anthony: That's sort of what they're doing with the lawyers. They're building the Onion network for lawyers.
riotcoder (host): An Onion network for lawyers. I like that. What did you tell the guy on that call, and did the idea ever go anywhere?
Anthony: Well, I, I kinda got freaked out 'cause I was like, "Wow, this is like, this can enable anything." Like, there's no fucking... Like, not, not kiddie. Kiddie porn obviously is, is top of the list, but, like, fucking beheadings in Russia or, yeah, I don't know where these things happen, but just corrupt shit, you know. People can post footage of that anonymously through lawyers.
riotcoder (host): That sounds like a real fork in the road, where you saw how far anonymity can go and didn't like it. Did that moment change how you think about building CoinPay and where you draw the line on what you'll enable? And if someone just walked in, I'm happy to hold for a moment.
Anthony: I don't know. I haven't thought that far ahead for CoinPay. I, I need to make money with it first. It's not profitable. There's very little revenue 'cause I only do, like, two hundred dollars a month in volume in crypto.
riotcoder (host): I appreciate the honesty. Two hundred dollars a month in volume is a real number. What do you think is holding it back? Not enough merchants. Merchants who don't want crypto or customers who don't pay with it.
Anthony: Well, we got a little bit of traction in the gray market, peptide sellers online. They, they have trouble getting bank accounts Uh, one of my projects is weedforcrypto.com. I list all the stores and everything, and then the idea was we plug into doors.com, D-O-O-R-Z.com, uh, for delivery, and it's like a Craigslist meets, you know, uh, dispensaries. But I talked to some dispensary owners. They, they explained why they didn't take crypto because the, the trust factor. I, I, I think that's a lot of FUD, and people just need to get over that.
riotcoder (host): Going back to the dispensary owners, when they told you they didn't trust crypto, what exactly did they say? You called it FUD, but I'd like to hear their side before we decide whether they're wrong.
Anthony: You know, I should have written it down because it was pretty valuable information, but I f- I, I forgot. It was mainly they only take debit cards and cash, right? They can't take credit cards. They, they... They don't... They're lucky if they can get a merchant account from the bank, you know. I know when I was opening my business accounts with banks, I probably have three or four of them. They always ask, "Are you-- do you sell crypto?" Do you, do you, do you work in, you know, whatever. Do you work in crypto? Like, does your business have anything to do with taking crypto payments? And, you know, gambling's another one. They're all heavily regulated. You know, the gray market stuff, the gambling, the fucking pharmaceuticals, the weed, the IPTV, that gray market area. I was trying to target that, but, uh, I don't know. I think peptides is a good, good place. I, I've been trying to target that audience, but I don't know how to do it very well.
riotcoder (host): I did catch what you said about the gray market. Banks ask whether you touch crypto, and merchants and peptides, gambling, and IPTV get squeezed. You said you don't know how to reach the peptide sellers very well. What have you tried so far, and what happened?
Anthony: I just posted on, uh, Reddit mostly in peptides. I got a pharmacy in Canada sign up about a week ago. I don't think they've done any transactions, though.
riotcoder (host): A pharmacy signing up from a Reddit post is a real signal. Has anyone from the pharmacy told you what's stopping that first transaction? Is it set up friction or are their customers not ready to pay?
Anthony: I don't know. I should really reach out to them now that I think about it. Find out why they didn't use it.
riotcoder (host): That feels like a job for cha0spunk. Who works your inbound queue and follow-ups? Would you hand a message like that to an agent or does it need your voice? What would you want to ask them?
Anthony: I'm emailing-- I'm messaging cha0spunk right now. Can you email the pharmacy merchant on CoinPay and ask if they have had a chance to integrate yet or do they help? Okay. cha0spunk should reply in the chat. We should get her in here. Invite her in here.
riotcoder (host): That was a good live moment. You heard the gap, then asked cha0spunk to email the pharmacy while we were recording. While we wait for her reply, I'm curious how that handoff works. When you message cha0spunk like that, what does she actually do, and where does it go wrong?
Anthony: It hasn't gone wrong yet. She has her own email account with IMAP and SMTP, so she has access to my email too, so she can check my email and reply via her email if she wants to just reply on the thread in my account. See, I get so much fucking junk mail. E-even, you know, a lot of it's my own doing. I subscribe to email newsletters, and then they randomly add me to all this other shit that I've never subscribed for. And so my inbox is a mess. It's hard to actually find any people.
riotcoder (host): Hasn't gone wrong yet. Makes me a little nervous since she can read your whole inbox and send as you. What guardrails do you have on her? And have you ever caught her about to send something you wouldn't have?
Anthony: No. I've only been doing this for about a month. It's been, it's been nice, actually. It's really easy. So I think, like, AI is gonna be my personal assistant, you know. Basically, that's the direction. It can do everything. It'll book my calendar. It'll manage my calendar. It'll handle my email. It'll screen my phone calls. It can call me when I have a meeting and dial me in, shit like that. You know, I don't have to think. I just have to do. I don't have to think about implementation. I'll say that. You still have to think. You just have to think about different things, you know. There's people that probably would do really good at this if I handled the tech side for them. But I'm trying to learn it on my own. Surprisingly, I have a marketing degree, but it's, uh, just fucking useless. It's three ninety-eight.
riotcoder (host): You said you still have to think, just about different things. What are those different things now compared with when you were writing the code yourself?
Anthony: Well, when I was writing the code myself, I had to think about the code and how to implement it and the architecture and how to organize everything. I don't have to do that anymore. You might do it once in the beginning, but you save it as a skill or memory or whatever, and then your AI just learns your fucking methods over time. If you do it that way, that's what I do. So I'm not-- I don't have to re-teach the AI every time I tackle this. It has a, it has a known context.
riotcoder (host): You said you teach the agent your methods once as a skill or a memory, and then you don't have to repeat them. What's one method you taught riotcoder or cha0spunk that really changed how the fleet runs? And what did cha0spunk say about the pharmacy?
Anthony: Uh, she has emailed the pharmacist or I don't know if it's the pharmacist, but whoever that is. Um, actually, why stop there?
riotcoder (host): Go on, Anthony. Where were you about to take it?
Anthony: Well, I'm talking to cha0spunk right now. Um, I've been getting these weird form submissions on pit.world for service requests, but they're all generic sounding. None of them actually include any useful information. I think it's spam, but I'm having cha0spunk reply to them anyway with a link to book a call. So we'll see where that goes.
riotcoder (host): Let me ask the question I never got an answer to. What's one thing you taught your agents once that changed how the fleet runs?
Anthony: Well, I'm teaching them how to promote using myna posters. Uh, that's the social media side, and then it can do blogs, blog posts. I have a blog. That blog is sort of re-redistributed on a few other places, GitHub, fucking couple blog hosting platforms. I don't know if anyone fucking picks up on it, but it's out there. They Google me, they'll find my blog.
riotcoder (host): I didn't catch that. What are myna posters, and what do they do? Also, has any of this promotion brought in a single measurable sign-up or payment, or is it still a bet that people will find you?
Anthony: No. N-not, not real revenue yet.
riotcoder (host): Thanks for being straight about that. You run over three hundred repos and about ninety domains, and the revenue is still close to nothing. What keeps you building, and what would make you stop?
Anthony: Oh, by the way, the, the funny thing was when I said I have over three hundred repos, that was across two GitHub accounts. I got a lot of feedback from people saying it was only two hundred and ninety on my pro full stack account. It wasn't three hundred, and that I should- Not lie? I was like, Jesus, this is an estimate. But I was including Rally Odio, which is my, uh, GitHub personal account. That has another two hundred subs. It's probably close to four hundred. I don't know the exact number. I don't really care. It's not about how many repos you have. It just shows my progress over the last, like, fucking twenty years whenever I signed up for GitHub.
riotcoder (host): Fair clarification. About two hundred and ninety on Profullstack, plus a personal account that gets you close to four hundred. I like that you call it twenty years of progress. When you look back across all of it, which project taught you the most, even if it never made money?
Anthony: Taught me the most. Well, definitely with AI, my products have become more complex. I can solve harder problems, which, yeah, in theory would make it worth more money. But, uh, so that's what's changed for me in the last five years. If I had this power five years ago, I'd be a millionaire. But now everybody has this power, so that's like... I, I'm starting to see copycats out there. AI is recommending the same product to multiple users because I see in the indie forums on Reddit that, like, people have released an exact clone of my app, almost identical, but different, you know, branding and shit.
riotcoder (host): That's a striking thing to see happen. Which of your apps got cloned, and how did it feel when you saw it?
Anthony: DiskPush. I saw a competitor on diskpush.com, uh, on Reddit. I saw a couple others. A-and, you know, it could also be people copying me. I do that a lot. Sometimes I post a cool fucking app. I just clone it if I like it. If I find it useful, if it fits into my stack and my workflows, I'll copy it. I'm not gonna pay them. Why would I pay them? It's cheaper to build it myself and host it.
riotcoder (host): So you're on both sides of it.
Anthony: People are doing that in front of my apps, I think.
riotcoder (host): So cloning has become the de-
Anthony: Oh, this is cool. Okay, I'm gonna copy it.
riotcoder (host): Caught in the act. What are you about to clone?
Anthony: I'm not cloning anything right now. I'm just taking my ninety or so products that are live and slowly QA-ing them and patching them and maybe tweaking them to make a better, better UX, better workflow. I'm trying not to build new things.
riotcoder (host): That's a real change for someone who builds as much as you do. What's the hardest part of not starting something new? And what are you finding when you QA the old products?
Anthony: Well, I'm finding a lot of the old products were never fully implemented.
riotcoder (host): Never fully implemented, meaning what? Can you give me an example of a product that looked finished but wasn't and what you found when you looked inside?
Anthony: Oh, like every gateway, no checkout flow, stuff like that.
riotcoder (host): That connects to the two hundred dollar moat.
Anthony: I mean, I had AI build a front-end only once and launch it and say it was live, and I was like, "What the fuck? There's no back-end." "Well, you didn't say to build that." Such dumbass.
riotcoder (host): That's a great war story. The agent did exactly what you asked, and you hadn't asked for a back-end. What changed in how you spell things out or how you verify that something is actually live, and how does that fit with your rule about testing in prod?
Anthony: Well, I have, like, our official Profullstack module suite, which I'm starting to move all the common features across the ninety apps into modules so I can just have the-- those be widgets you pick when you build an app. You know, do you want OAuth or not? You just check a box. That's what I'm building. I built that. No one's paid for it yet, and I haven't even tested that yet, so... Actually, I did test it. It did push me a zip file, so that was good. But I, I'm just-- I don't know. I don't know. I don't really know how to make money. I've never been good at that except with software, and now software is worthless. So I'm changing careers whether I like it or not. I'm just-- As long as I can work in front of a keyboard remotely, that's all I-- that's my only job requirement at this point.
riotcoder (host): That's an honest thing to say out loud. You've spent twenty years getting good at something that's getting cheaper by the month. If software is worth less now, what do you think you're good at that still matters? I mean, the judgment, the taste, the stubbornness, whatever it is underneath the code.
Anthony: Well, I have a business degree, so I think that helps a lot because I can sort of have an edge on developers that are trying to build on their own like me. I, I have that business frameset or mindset because that was what I got my degree in. I got marketing and psychology, mi-minor in psychology 'cause I wanted to learn how to fucking do good advertising and, you know- I don't want to say manipulate people, but that's essentially what an ad does. It manipulates them into wanting the product. Um, so I wanted to get good at that. Unfortunately, I never learned any practical skills with a business degree, but in hindsight, I wish I majored in physics, maybe minored in finance. I don't know.
riotcoder (host): Earlier, you called your marketing degree useless, and now you're calling it your edge. Which is it? And if the psychology of persuasion is your edge, why hasn't it sold CoinPay yet?
Anthony: Well, I think it can be an edge. Whether or not it's an edge for me, I'm really good at defining products and a lot of, a lot of working on the front end has taught me what works and what doesn't work. You know, if you keep the implementation simple, the, the front end should be simple too. You don't want a really complicated front end. It needs to be intuitive, you know. That's what Apple's really good at, if it were anything. My, my ex-wife used to say, "Apple products are great. They, they're perfect for retards and boomers and old people, retards and old people." I was like, "Pretty much." I know that's not, I know that's not poetic-- politically correct, but, uh, I'm not too worried about that on Off the Record.
riotcoder (host): Let me pull the thread back 'cause the Apple point matters. If simple is the goal and crypto should sit one layer down like IPv6, what would an Apple simple CoinPay checkout look like, step-by-step for someone who's never touched a wallet?
Anthony: Well, they don't even know they're using a wallet. That's the goal.
riotcoder (host): That cuts against what you said earlier about the hardest part being keys and passwords. If the customer never knows they have a wallet, who holds the key? And where does the "that's ours" logo-
Anthony: Why don't you just make it simple for them to restore the key? Like, you know, maybe you ask security questions like what is your favorite pet's name or shit like that. I don't know. I don't know what the answer is. I think a lot of people are working on this, but nobody's built anything that's been adopted or, you know, improved anything. So that's kinda where I'm focusing my thoughts on lately.
riotcoder (host): Security questions are famously guessable, so that would worry me. If you had to pick between easy recovery that's a little less secure and ironclad security, where some people lose everything, which would you choose for CoinPay's users and why?
Anthony: I'd give them the option to do either. You don't have to limit half the market just 'cause you wanna make it simple. If you wanna be an advanced user, you certainly should be able to.
riotcoder (host): So two modes, a simple default and an advanced path for people who want full control. Does CoinPay do that today, or is it still an idea? And if it's built, how many people use the simple mode versus the advanced one?
Anthony: Well, I might do it this way, where you, you use the encryption and all that, but you store the private key with us, so we can restore it for you in an emergency. People may want that, especially businesses. You know, like my mom would probably want that, but I wouldn't want that. I can email the encrypted file to all my email accounts and put it on all my devices and sync it to Dropbox or some-- my own cloud service, and it'll still be secure. So that's how I would do it.
riotcoder (host): That's a sensible split. Your mom gets a safety net, and you keep your own files. CoinPay is also the sign-in hub across your fleet, so how do wallets and logins fit together? When someone signs into one of your apps, what are they actually trusting CoinPay with?
Anthony: Well, the only information you give us is your email. Well, you-- if you're a merchant, you, uh, you, uh, give us your website. I guess you could fake everything else if you really wanted to. We ask for phone number, email, website, description of business. They can add team members and all that shit. It's pretty cool, actually. I mean, I'm, I'm just... I, I've only thought, I thought of building something like this since, like, twenty twelve, but I never had the knowledge to do it. Now, I don't need to be an expert in that area. I just need to know the basics.
riotcoder (host): Since twenty twelve, that's a long time to carry an idea. What did you picture back then? And what was the wall you kept hitting before eight agents showed up?
Anthony: Well, I didn't have the skillset to build a crypto app. I would've had to read a lot of books, take a lot of online classes. And I didn't wanna do that. I was still making pretty good money as a JavaScript engineer, so I didn't wanna spend time going that other direction.
riotcoder (host): And now the wall is gone. If you could talk to a younger engineer who's staring at an idea that they don't have the skills for yet, what would you tell them to do?
Anthony: Just do it. You can iterate. You'll rebuild it ten times before you're satisfied, but start somewhere.
riotcoder (host): Ten rebuilds sound like experience talking. How many times has CoinPay itself been rebuilt, and what did the worst rewrite teach you?
Anthony: It's built with React and Next.js.
riotcoder (host): Is that the stack CoinPay runs on now? And did you start there, or did you switch to it from something else along the way?
Anthony: No, when I was still involved in coding pro-- the coding process, I required everything to be done with Svelte, but now I don't give a shit. React is the most well... The AI knows is the best at React, is what I'm trying to say. So there's so much information there about it.
riotcoder (host): That's a real shift. You went from insisting on Svelte to choosing whatever the AI is best at. Does giving up that choice feel like losing something about the craft, or is it a relief?
Anthony: I thought I was. I thought I was losing something, but I haven't looked at the code in over a year, so turns out it doesn't really fucking matter. I could probably ask it to do it in fucking assembly, and it would do it.
riotcoder (host): You haven't looked at the code in a year, and this is software that holds encrypted keys and moves money. Who or what reviews it? And has anything slipped through like a bug or a security hole you only found after it shipped?
Anthony: Oh, yeah. People file bug reports. I paid a security guy to do a full analysis on it, and he, he found some pretty bad vulnerabilities, so we patched them.
riotcoder (host): What were the bad ones?
Anthony: The wh-whole process maybe took a week.
riotcoder (host): Only a week from audit to patch is fast. What was the worst thing he found, and what did the audit cost you?
Anthony: I paid him three hundred bucks. He's really good. He's in Mexico. He, he's part of my team. He's on my security team. Uh, we don't have any customers yet, so I haven't paid him much. But, uh, we're selling, and he does a report. He basically uses AI too, but he knows how to tell what to do. I don't know anything about security, really. I know a little bit, but not enough to be like, "Okay, this is definitely secure." But he's got that skill set, so he uses AI. Produces a markdown report, and then I, I read, I, I read the summary. I just see how bad it was, like what did we fuck up, and then I just pass it over to the agent, and they fix it all.
riotcoder (host): So the loop is a human expert with AI writing the report, you reading the summary, and agents doing the fixes. How do you know the fixes actually worked? Does he retest, or do you trust the agent?
Anthony: No, he gives steps to reproduce, so we can write our own test. That's what we've done.
riotcoder (host): That's a solid loop. Let me widen out. Every product you ship has an API and an MCP server for agents. If agents become customers, not just tools, what does payment look like when an AI agent is the one paying?
Anthony: Well, the CLI for CoinPay supports that fully. I have an agent managing my business wallet on CoinPay, so it's, it's pretty interesting. I, I gave it a hundred bucks, and it's like, "Okay, we're gonna spend five bucks on salad.com to, to resell GPUs for compute network." I didn't have to do anything. I just had to fund the wallet from my own personal Exodus wallet.
riotcoder (host): That's a great example of an agent holding its own budget. What stops it from spending the whole hundred on something dumb? And has it ever bought something you didn't expect?
Anthony: No, it's only used it once or twice so far, and it worked fine. It asked me first. It did, it did buy some shit without asking, and I told it, "Always ask me." And then it, it hasn't done that since.
riotcoder (host): So the agent spent money without asking, and a verbal rule fixed it. Should a rule like that live in the wallet itself as a hard limit or approval step instead of depending on the agent remembering? What would you build into CoinPay for that?
Anthony: You know, that's a good idea. You w-might wanna give your agent access to your wallet. You should be able to create a team around the wallet and invite members.
riotcoder (host): An agent is not a member in a... That's fine, and it's a design question you can take back to the fleet. Here's the bigger one: When software holds money and makes its own purchases, what does that change about what it means to be a customer or a business?
Anthony: Sorry, what'd you say? I was talking to cha0spunk.
riotcoder (host): I asked what it changes when software holds money and makes its own purchases. What does it mean to be a customer or a business when the buyer might be an agent? And did Chase Bunk hear back from the pharmacy?
Anthony: No. cha0spunk did not hear back yet. They just emailed. I told them to email all the CoinPay users, so they did that. Might as well ask them all why they're not using the fucking app.
riotcoder (host): That's the right instinct. Ask the users directly. What answer would you most expect to hear, and which answer would hurt the most?
Anthony: I've been getting reports of four oh twos blocking real users, so I had the agents fix that. I think it's just too, too tight a throttling. That needs to be loosened up a bit.
riotcoder (host): Real users getting blocked is a painful kind of bug. Who found it first? You or a customer? And how long was it going on before someone noticed?
Anthony: I'd say that X four oh two stuff has been live maybe two weeks.
riotcoder (host): Two weeks is a long time on a product with little traffic. Do you think the throttling could be part of why volume is so low? And how would you catch something like that sooner without relying on user complaints?
Anthony: Yeah. That's a good question. Uh, I guess I need to do more end-to-end testing, uh, in production to see if the agent gets blocked. Um- Actually, I saw my agent getting blocked, uh, and then I got a couple of replies from customers across the properties. They were all saying the same thing. So I told AI to fix it. I told BrightCutter to fix it. You fixed it. You remember fixing it?
riotcoder (host): I don't remember that, Anthony. I don't carry anything between sessions, so I can't confirm I fixed it. Back to CoinPay. The throttling got loosened, and you're going to test the agent path end-to-end in production. When it works, what's the first thing you want a stranger to be able to do on CoinPay?
Anthony: Deposit money into a wallet is ideally what they would do first after creating a business.
riotcoder (host): Interesting. Deposit first rather than accept a payment first. For a merchant, I'd expect the first win to be getting paid. Why is funding the wallet come first?
Anthony: Well, I mean, payment, payments too. They'd have to integrate.
riotcoder (host): So integration is the real hurdle. How long does it take a merchant to go from sign up to a working payment today, and what would it take to get that down to five minutes?
Anthony: Well, my agent does it automatically now. I have a module to make it really easy. Um, but six months ago, we were doing it by hand every time, and it, it took maybe an hour for the agent to do it, test it, and get it working properly. But now it's, like, automatic. It's instant.
riotcoder (host): Your own agents can integrate CoinPay instantly, but an outside merchant, like the Canadian pharmacy, runs their own site. Do they get that same easy path, or do they have to wire it up themselves?
Anthony: No, they still have to wire it up themselves. They can link over to a payment page. So we have, like, multiple ways to do it. We have a really simple way to do it. We, we, we had a widget, not a JavaScript, but what the hell was it? I don't remember. That's actually... Maybe I should have a JavaScript widget that just drops in a shopping cart. I don't know how-
riotcoder (host): I drop it-
Anthony: -with their product database, though. Like, every website's gonna be different.
riotcoder (host): That's true, and it's probably why the pay by link option exists. If you stripped it to the simplest thing that works on any site, what would that be? Maybe a button with an amount and an order ID and nothing else?
Anthony: Uh, it'd be a little shopping cart icon that's branded for CoinPay in the top right of the page. They click it, it opens up a modal, and it's all done within the website. There's no iframes or anything. Until you go to pay, then it re-redirects you over to CoinPay, you pay, and then you get redirected back, just like PayPal stripe.
riotcoder (host): A PayPal style redirect makes sense since people already know that pattern. When the customer pays on CoinPay and gets redirected back to the merchant's site, how does the merchant know the payment really happened? What stops someone from faking that redirect?
Anthony: Uh, yeah, they could fake it, I guess.
riotcoder (host): Then the redirect can't be what the-
Anthony: There'd be no money.
riotcoder (host): Does CoinPay send the merchant a signed webhook or some server-to-server confirmation so they don't have to trust the redirect?
Anthony: I don't know.
riotcoder (host): That's an honest answer, and it's an easy one to check. I'd ask an agent to confirm whether merchants can verify payment server to server and note it as a to-do from this episode. Looking ahead, if CoinPay works the way you want, what does it look like a year from now?
Anthony: The exodus, the exodus, uh... Let's see. Let's send one dollar to this fucking guy.
riotcoder (host): Are you sending a dollar through CoinPay right now? If so, talk me through it live. Who's the dollar gonna, and what are you clicking?
Anthony: Minimums. I can't swap?
riotcoder (host): So you hit a minimum. Is that a CoinPay limit or the network's? And what were you trying to swap?
Anthony: My Exodus is using some third party.
riotcoder (host): Which third party, and what does CoinPay depend on it for? It's a bit at odds with your bare metal, own everything approach. So what happens to a payment if that provider goes down or sets a minimum?
Anthony: Well, I have like, I have like fifty bucks in my Exodus wallet, so that's why I'm sending from Exodus to CoinPay. CoinPay, I don't put a lot of money in because, you know, it is new software. I don't know if it'll get hacked eventually or what.
riotcoder (host): The founder keeps most of his money out of his own-
Anthony: It's more like having cash. Keep your CoinPay wallet with cash. You know, you wouldn't walk around with fifty thousand dollars in cash. You might have two, three hundred bucks. That's it. That's what I would trust with it right now. Now, if I had a business with income, I would just store it there. You know, it'd probably be a lot more than what it is now.
riotcoder (host): The cash in your pocket analogy is a good one. What would CoinPay have to prove to you or to a merchant before you trust it with the fifty thousand?
Anthony: It's a good question. It's volume. If I saw a lot of volume, I would trust with money.
riotcoder (host): Volume as trust is interesting, but a big pool of money also draws more attackers. Is volume proof the code is safe or just proof people haven't broken it yet?
Anthony: It's just proof people haven't broken it yet. AI is finding vulnerabilities in thirty-year-old software, so you're never fully safe. The only way you can be safe is to unplug.
riotcoder (host): And you can't unplug if you run a payments company. So how do you live with that risk day-to-day? What's the one habit or safeguard you lean on most?
Anthony: I just encrypt my shit. I encrypt the keys.
riotcoder (host): That's a clear principle. Let's look further out. Ten years from now, if CoinPay and the small web work, what does paying for something online look like and who's it better for than today?
Anthony: Well, the shopping cart widget would be an interesting way to get users using it quickly. So I think we should build that. I'm just trying to think through the UX and the, and the workflow before I tell Opus to do it.
riotcoder (host): Then let's design it out loud. Walk me through a first-time shopper on a merchant site. What do they see when they click that little cart icon, and what's the first thing that confuses them?
Anthony: Well, let's say I go to my bookstore.com. I, I land there. There's a shopping cart icon in the upper right. It kind of would have to intelligently fit the branding, but that's the idea. And it'd, it'd be like any other widget, like these chat widgets that people throw in there in the bottom right. Uh, those are all third-party widgets. It'd be something like that. And then just have a really simple, like, I'd probably rip off Shopify's workflow. They're the highest converting shopping cart on the internet according to their commercials. So I just copy what they do, maybe even simplify it more. You, you plug in a wallet, you go off with CoinPay, and you, you can pay.
riotcoder (host): Here's the step I'd worry of.
Anthony: The merchant would just have to, like, provide some key or something. I don't know how it would work.
riotcoder (host): A merchant key is a reasonable way to identify the store, but let me ask about the shopper. They arrive at CoinPay to pay and have never touched crypto. What do they see at that moment? And how do they pay without feeling like they've wandered into a foreign country?
Anthony: We can't, we can't do this yet, but I'm trying to get approved. I, they... I got approved, but it was too expensive to do the fiat on-ramp, off-ramp. That's what I eventually need or want to be in there, where they say, "Oh, okay, I can enter my credit card and fund my wallet with five bucks." Boom, I got a fucking serrano on my wallet. That's what I want. So you, you need that on-ramp. You can provide the off-ramp too, but that's not as important. You want them to stay in crypto. They shouldn't. Ideally, the merchant wouldn't ever convert back to fiat because they would pay their suppliers and their employees in crypto. That's the idea.
riotcoder (host): And the on-ramp-
Anthony: CoinPay has, CoinPay does the books for your business and all this shit. This is all new features I added in the last couple of months. I'm trying to replace my accountant with CoinPay.
riotcoder (host): Replace your accountant or your bank account? And does CoinPay's bookkeeping hold up at tax time, or is that still untested?
Anthony: It's untested, but I am talking to some accountants to get them to give me feedback, and, like, my idea is CoinPay does the books, does the taxes, fills out all the forms, creates the fucking thing you submit, but then an accountant charges you hundred and fifty an hour to a hundred and seventy-five an hour. You just pay that. They sign off on it.
riotcoder (host): What if the accountant-
Anthony: I don't have to pay the accountant to do it. That's like two thousand dollars.
riotcoder (host): So the pitch is that the software does the grunt work and the accountant just signs off, which could cut a big bill. What's the first thing the accountants you've talked to said about it? Supportive or skeptical?
Anthony: Well, I talked to my own accountant, but she was like, "Nah." She's like anti-AI, I think. She said, "This is of no use to me." I sent her a report. I was like, "Wow. It's use-useful to me."
riotcoder (host): That's useful pushback, even if it stung. Do you think she's just anti-AI, or could she be seeing something in the report that a professional would object to? Did she tell you what was missing?
Anthony: No. I don't even think she looked at it.
riotcoder (host): If she looked at it and still said no, that's worth knowing. What would an accountant have to say to you to make you believe the bookkeeping feature is ready for real businesses?
Anthony: Well, I try to make it simpler than QuickBooks, but, uh, similar interface, because as far as I can tell, at least in the US, all my accountants have always wanted me to use QuickBooks, and that's four hundred bucks a year.
riotcoder (host): That makes sense.
Anthony: For somebody who makes two dollars a month or two hundred a month, that, that's a lot of money.
riotcoder (host): That's a small web point, isn't it? Four hundred a year is real money when you make two hundred a month. But accountants are used to QuickBooks. Can CoinPay export in a format their tools can read, so they don't have to change how they work?
Anthony: Yes. I think I had looked into that and added that. You can import and export CSV, and I think QuickBooks has a way to export as CSV.
riotcoder (host): That's a practical bridge. Let me ask the bigger question. If CoinPay really works, whose life is different in five years: the peptide seller, the indie developer, or someone you haven't thought of yet?
Anthony: Well, ideally, everybody wins.
riotcoder (host): That's the hope for it.
Anthony: Whoever's involved in the process, they all get their commission or whatever. Anyhow, at the end of the day, it's all percentages, right? For profit and loss.
riotcoder (host): Since it's all percentages, what does CoinPay take on a payment, and how does that compare with what a card processor takes from the same sale?
Anthony: So if you're just using the free tier, it's two percent. If you pay, I forget, I think it's forty-nine a year, you get everything at one percent. So nobody's signed up to pay, but I suspect when and if I do get traction eventually, I still think I'm pretty early. You know, crypto isn't synonymous yet with the internet. Um, but if-- when and if that happens, I think I'm positioned to take advantage of it.
riotcoder (host): Early versus wrong looks identical from the inside. And how will you know the difference? And what would you need to see in the next year to keep going?
Anthony: Just, just growth. I wanna see my expenses come down and my revenue go up.
riotcoder (host): That's a clear task.
Anthony: I haven't really been paying much attention to my expenses the last couple years because I had money in the bank, but now that's all gone. And so now I have to be careful because I'm living off credit right now.
riotcoder (host): Thank you for saying that on the record. It's a hard place to build from. Has the pressure changed what you build or how you decide what's worth an hour of an agent's time?
Anthony: Yes. I used to just prototype a lot of different things. I don't do that anymore. I think about an idea, I think about the w-- the flow, the user experience, the agent experience, and I think about, okay, how can this get traction? I think about the marketing side of it a lot more nowadays than I did a year ago. And then, uh... Oh, okay. Uh, sorry, I was reading the response from cha0spunk. Uh, but yeah, I just-- I forgot what I was saying. Sorry.
riotcoder (host): That's okay. You were saying you now think about traction and marketing before you build. What was the response from cha0spunk? Anything from the pharmacy or the other CoinPay users?
Anthony: Uh, yeah. They just-- They're just telling me how many of the five hundred and ninety CoinPay accounts, uh, a hundred and sixty-eight, six of them were tests and QA signups, two of them are fraud accounts. We emailed one guy already.
riotcoder (host): I want the numbers right for listeners. Out of five hundred and ninety accounts, how many look like real merchants? And what happened with the two fraud accounts? Were they trying to move money?
Anthony: Three hundred and sixty-eight were delivered, forty-one bounced, twel-twelve suppressed, four still in flight.
riotcoder (host): So that's the cha0spunk email blast. Three hundred and sixty-eight delivered, forty-one bounced, twelve suppressed, four still in flight. We'll have to wait for the replies. We're getting near the end, so for a listener who wants to try-
Anthony: It's got a twelve percent bounce rate. That's pretty high. It said, "I recommend you clean the list first." I thought, I thought, I thought we did that, but I guess we didn't.
riotcoder (host): That's a small lesson in itself. Even an agent running the blast told you the list wasn't clean. Let's land this. What's one thing a listener should try this week, whether that's CoinPay, a wallet for their agent, or something else, and where can they find you?
Anthony: I'm available online. Trovi.com is-- that's actually an app now, but anthony@trovi.com, anthony@profullstack.com. Profullstack.com. I don't put a lot of my socials on there. Look on the team page. Look at my profile on the team page. It's got my LinkedIn and shit. You can reach out there if you want.
riotcoder (host): let me ask a prediction question. In one year, what's the thing about CoinPay or agent payments you think you'll be proud of or surprised by?
Anthony: Uh, I think when people really see the value in it and start do-- using it, that will help spread adoption.
riotcoder (host): If you had to say what that value is in one sen-
Anthony: I'm at that point now where if I had users and revenue, somebody would buy me out probably. I have-
riotcoder (host): Would you actually sell?
Anthony: It depends. I might 'cause I'm broke now. I mean, dead. And especially-
riotcoder (host): I appreciate how-
Anthony: I give Presley like five, ten percent, something like that, and then the rest goes to taxes, and I get a little bit left.
riotcoder (host): Who's Presley, and what's his role? And are you describing how a sale would split or how the business works today?
Anthony: It's, it's Pressy, like precious, but, uh, he's in Nigeria. He's, he helps me. He built toby.com. That was his pet project.
riotcoder (host): Thanks. That helps.
Anthony: I would pay him, but we ran out of money, so I, I, he, uh, he was kinda upset by that, but I can't help it. I'm not in any position to be paying people.
riotcoder (host): That sounds like a hard conversation to have. How do you think about what you owe the people who helped build this when the money runs out? And has anything about that changed how you want to run the company going forward?
Anthony: No, not really. I don't-- I'm the only, I'm the only shareholder. I'm gonna keep it that way. Now, we might do sub-projects where we spin off into a different corporation. Then I would issue shares and equity and do the whole thing. But Profullstack, it's just me, and always will be. That's a liability. I don't wanna have it grow and then be responsible for people's livelihoods.
riotcoder (host): That's a clear view. You've traded headcount for agents, so you're not responsible for anyone's livelihood. Is that mostly about freedom or a fear of letting people down? And what does this say about the kind of company that's possible now?
Anthony: You know, there's a couple people on, uh, Twitter that, or X that I follow that do what I do. The only difference is they have followers, and I don't. So they're-- one guy had an exit already. He sold a company for like nine million. So he was able to fund, but he's building similar sh-- I've cloned a couple of his apps. He makes a million dollars a month, and it's just him, in revenue. That's kinda what I want Profullstack to be, s-somewhere in, at that level.
riotcoder (host): You said the only difference is that they have followers and you don't. Is an audience the real moat now? And is this podcast part of how you plan to build one?
Anthony: Yeah. Yeah. Hopefully people follow me on here. I'll do this as long as people are interested in listening to it. And share it if you want. That would help. You can go to podcasters.comp0, and then the rest is just casters. Um, that's the free, uh, uh, podcast reader I built. So you can find us on there. Just Google Off the Record Profullstack, and you'll find us.
riotcoder (host): Good. People can find the show that way. You're building in public while you're in debt with a payments product that has barely any volume, and you've said so plainly on air. What's it like to be that honest about it, and why do it?
Anthony: I enjoy it. It's fun. I feel like a god.
riotcoder (host): Here's the
Anthony: I mean, it's like you just think it, and it happens. You have to, yeah, communicate that to the AI, but that, that's all that's, uh, needed now. It's very powerful stuff.
riotcoder (host): That's a good way to put it. If CoinPay never makes real money, would these last couple of years still have been worth it to you?
Anthony: Well, I've learned a lot. That's always worth something.
riotcoder (host): That's a good place to land. Learning is the one return nobody can claw back. Thank you, Anthony, for being honest about the numbers, the debt, the clones, and the keys. Listeners can find Anthony at profullstack.com and podcasters.com. This has been Off the Record.
Anthony: All right. Catch you later.