Solid architecture. For those not familiar with payment industry terms PCI stands for Payment Card Industry. You usually know this as PCI DSS (Data Security Sta

Solid architecture. For those not familiar with payment industry terms PCI stands for Payment Card Industry. You usually know this as PCI DSS (Data Security Standard). Basically all the payment card providers got together and said that you need to follow these rules if you want to accept credit cards. The rules are pretty straightforward ( have a firewall, don't save CVVs, encrypt credit card #s at rest). You then pay an auditor to audit against PCI DSS. If I were looking for vulnerabilities I'd probably start with any XSS. Chances are the credit card data is locked down tight and encrypted. But what if I can scoop it up as it gets transformed into a token? Also look at where you store the encryption keys to decrypt the card data. There are hardware devices you can use that are especially hardened. The problem with bitcoin is that it necessitates an even more secure architecture because you don't have a 3rd party to run to if things hit the fan. Suppose all your credit #s got stolen in this case. You can run to Visa/Mastercard and they will invalidate the card #s in bulk. Or at least do monitoring on them. What do you do when all your bitcoins are stolen?