There's been a statement there the entire time.

Keep spreading FUD though, it seems like the only thing you're good at.

This is all really bad timing.

The payments blackout (which has been scheduled for a long time) right after the metro bank issue and my mistake of accidentally marking payments as sent all came together to make what would have individually been a nuisance into a real problem.

If you have a withdrawal request marked as sent which you have not received (and it has been more than 48 hours) open a ticket clearly indicating the withdrawal request is marked as sent.

If you have a withdrawal request marked as requested do not open a ticket it will just be closed.

Do you believe you or someone else has successfully been compromised by having their API accessed from an IP which was not theirs? If you only access from a given IP, why not keep the API key only on that box and not floating around in other places?

To be clear, I am not against this feature but do want to flush out the use case a bit more. Sometimes things that seem like security really just add more headache and little security.

I accidentally marked a bunch of payments as sent which shouldn't have been.

Mostly this effected people with bitcoin transfers (almost all of which have now been corrected), but some UK transfers were also effected.

If a UK transfer is marked as 'sent' and you have not received it after 48 hours open a ticket and someone will investigate.