Crypto Payment Volatility 2026: The Smallest Risk
We measured 43,185 invoice windows on 22 September 2026. Crypto payment volatility costs a merchant far less than every other deduction in the stack.
Key Takeaways
- Crypto payment volatility is the smallest deduction in the merchant's stack, and it is the one the whole industry sells protection against. Across 43,185 fifteen-minute windows measured to 22 September 2026, the median Bitcoin move was 0.084% and the average 0.128%.
- A 1% underpayment tolerance survives ordinary price movement 99.89% of the time on Bitcoin. Movement alone pushed a correctly-paid 15-minute invoice more than 1% short on 0.11% of Bitcoin windows and 1.10% of XRP windows — against an exchange withdrawal fee that took 11% off a 50 dollar invoice in our September measurement.
- The rate lock is a product with a published price, and it is dear. NOWPayments charges 1.5% for a fixed-rate payment against 1% for a plain one. That half-point buys cover against an average exposure of 0.062% on a 15-minute Bitcoin invoice — roughly eight times the risk it removes.
- Window length matters far more than the coin. A 1% adverse move hit 0.11% of 15-minute Bitcoin windows and 2.48% of two-hour ones; on XRP the same stretch runs from 1.10% to 11.12%. CoinGate holds an unselected order open for exactly two hours.
- Settling in a stablecoin removes the risk for nothing. USDC's median 15-minute move was 0.000% and its worst move in thirty days was 0.03% — expected exposure of 0.0025%, about 200 times cheaper than paying for a lock.
Table of Contents
Your invoice window is a rate lock
Every gateway on the market sells you protection from crypto payment volatility, and almost none of them will tell you what the risk is worth. The pitch is always the same: the market swings, so lock the rate, or auto-convert, or pay a little extra for a fixed quote. It is a good pitch because nobody can price what they are being protected from. So we priced it. We pulled thirty days of one-minute closes for seven trading pairs from KuCoin's public API — 43,200 minutes each, from 23 August to 22 September 2026 — and measured how far the price actually travelled inside the payment windows those same gateways publish.
Start with what the window is for, because it is routinely misdescribed as a blockchain constraint. It is not. BTCPay Server's documentation says it plainly: invoices "lock the exchange rate within a specified time frame to protect the receiver from price fluctuations". The timer is an FX quote with an expiry, which is why the same fifteen minutes turns up on gateways whose fastest supported chain settles in under a second. We took the timers themselves apart in Crypto Invoice Expiry 2026; this piece asks the next question, which is what the thing behind the timer is actually worth.
The answer turns out to be uncomfortable for the marketing, and it cuts in a direction we did not expect when we started.
What 43,185 windows actually did
For each of the 43,200 minutes we took the close, looked fifteen minutes ahead, and recorded the percentage change. That gives 43,185 overlapping fifteen-minute windows per pair — every possible moment a customer could have opened a checkout over a month, not a handful of cherry-picked ones. The prices are KuCoin spot mid, the same source we used for the withdrawal-fee measurements in September, so the figures are comparable across our recent work.
The median row is the one to sit with. Half of all fifteen-minute Bitcoin windows in a month moved less than 0.084%. On a hundred-dollar invoice that is eight cents, in either direction, and the direction is a coin flip: prices fell in 50.0% of Bitcoin windows and rose in the rest. This was not a quiet month either — Bitcoin ran from 77,236 to 85,988 dollars over the thirty days, a +11.3% trend, and Solana added 22.7%. A strong trend does not show up at fifteen-minute resolution.
The XRP row carries the one genuine warning in the table. Its median is unremarkable at 0.174%, but its worst fifteen-minute fall was -7.41%, three times Bitcoin's worst. Tail risk and typical risk are different animals, and we come back to the tail below.
How often movement alone breaks a tolerance
An average is not a decision. What a merchant needs is the failure rate against the number actually configured in the dashboard: the underpayment tolerance. CoinGate lets you accept orders underpaid by "up to 10%" and recommends "a smaller amount, such as 1-2%", which it says "will most likely cover over 90% of orders that are accidentally underpaid". Cryptomus caps its accuracy_payment_percent at 5%. So we counted, for each asset, the share of windows in which the price fell by more than each of those bands — the one-sided case where a correctly-paid invoice is worth less on arrival than it was when quoted.
A 1% tolerance survives ordinary Bitcoin movement on 99.89% of fifteen-minute windows. Roughly one invoice in nine hundred would be pushed past it by the market. On Dogecoin, the worst of the seven at this band, it is about twelve per thousand. CoinGate's recommendation is sound, in other words — but the reason it gives is not the reason it works.
Read CoinGate's own guidance carefully and it names two causes of underpayment, both of them operational: "exchanges often deduct a fee when sending it", and transaction delays. Price movement is not on the list. That matches what we found on the withdrawal leg: a fifty-dollar invoice paid from a KuCoin Ethereum balance arrives 11% short, because the exchange takes its fee out of the amount rather than adding it on. Set against 0.11%, the fee is the cause about a hundred times more often than the market is. Your tolerance is an exchange-fee budget that happens to also absorb some volatility, and the diagnostic path for an invoice that never completes is in Crypto Payment Not Received.
The clock costs more than the coin
The single biggest lever on window risk is not which coin you accept. It is how long you leave the quote standing. Re-running the same one-sided test at every published window length shows the exposure compounding with the square root of time, exactly as theory predicts, which is a useful sanity check that the measurement is not an artefact.
Going from fifteen minutes to two hours multiplies the Bitcoin breach rate by 22 and the XRP rate by 10. At the top of that table, more than one XRP invoice in nine would have moved past a 1% tolerance on price alone. That is a real number, and it lands on CoinGate's two-hour new status — the clock that runs before the shopper has even picked a coin.
So the honest version of the industry's claim is narrower than the claim itself: volatility is negligible at fifteen minutes and material at two hours, and the gateways that publish the longest windows are not the ones selling you the lock.
What each gateway actually locks
We read six gateways' own documentation on 22 September 2026 for two things: how long the quote stands, and whether the rate is locked at all. The second question turns out to be the interesting one, because the answers are not uniform and one of them is a plain no.
Plisio is the outlier and it is worth reading its field definition twice. Its documentation defines source_rate as the "exchange rate from the 'psys_cid' to the 'source_currency' at the moment of transfer". At the moment of transfer, not at the moment of invoice creation. On a plain reading there is no lock at all, and the merchant carries whatever the window did. Plisio also publishes no default for expire_min, so a merchant who never sets it cannot tell from the documentation how long their own exposure runs.
- NOWPayments' own pages disagree on the price. Its help centre lists 1% for payments without exchange and 1.5% for "multi-currency payments, Fixed rate payments and 'fee paid by user' payments", while its blog page describing the feature says "the fee for using the Fixed Rate is 1%". Both were fetched on 22 September 2026. We use the half-point uplift from the fee page and flag the conflict rather than picking the flattering number.
- The freeze length is disputed too. The same blog page says "the rate freezing period is 10 minutes"; search summaries that day quoted 20. Check it in your own dashboard before you build against either.
Is the lock worth what it costs?
Now the two halves can be put together. A rate lock is insurance, so price it the way insurance is priced: the expected loss it covers. For every window we took the adverse move only — the fall, counting a rise as zero, because a rise does not cost the merchant anything — and averaged it across all 43,185 windows. That is what an unlocked invoice costs on average, per invoice, before any fee.
On a fifteen-minute Bitcoin invoice the lock sells for eight times the risk it removes. That is not scandalous for an insurance product — an insurer has to cover the tail, and Bitcoin's worst fifteen minutes this month was a 2.26% fall, 36 times its own average exposure. But eight-fold is a wide margin, and it is wider still on a stablecoin, where the same half-point buys cover against a risk of a quarter of a basis point.
The bottom row is where the product starts to make sense. Let a volatile coin sit in a two-hour window and expected exposure reaches 0.337%, which makes a half-point charge roughly fair. That is the rule worth taking away: a rate lock is priced for a long window on a volatile coin, so it is only good value if that is what you are running. We measured a separate, quieter charge on the same leg — the spread between a gateway's quoted rate and the exchange mid, which ran from 0.06% above to 0.99% below in our September rate survey, and which you pay whether you lock or not.
Volatility against the other deductions
The reason any of this matters is opportunity cost. Attention spent on volatility is attention not spent on the deductions that are one and two orders of magnitude larger. Here is the full stack on a single invoice, every line measured by us in the last three weeks or read from a first-party page this week.
Volatility is the last line but one, and the line above it is eight times bigger and entirely optional. The largest single number in the table is a fee charged by a company you have no relationship with, deducted from money your customer believed they were sending you in full. If you fix one thing this quarter, fix that one — and the mechanics of the floor it creates are in Minimum Crypto Payment 2026.
What to set on Monday morning
Four settings follow from the measurements, and none of them costs anything to change.
- Shorten the window before you buy a lock. Cutting a quote from two hours to fifteen minutes removed 95% of the Bitcoin breach rate in our data, free. Paying half a point to freeze a rate you could simply have expired sooner is the wrong order of operations.
- Set tolerance from your customers' exchange fees, not from volatility. Work out the withdrawal fee on your smallest invoice and size the band to that. A 1-2% band covers ordinary market movement on better than 98% of windows for every asset we measured, so anything above that is paying for fees.
- Default the checkout to a stablecoin. It removes window risk almost entirely for nothing, and it also avoids the tail — USDC's worst thirty-day move was 0.03% against XRP's 7.41%. Our stablecoin payments guide covers the settlement side.
- Only pay for a lock if you run long windows on volatile coins. On a fifteen-minute stablecoin invoice the fixed-rate option costs roughly two hundred times the risk. On a two-hour XRP invoice it is close to fair.
One caveat we will state rather than bury. This is one month, 23 August to 22 September 2026, in a market that trended upward without a dislocation. A month containing a genuine crash would push every number in the tables up, and the tail figures furthest. The method is three lines of arithmetic over a free public endpoint, so re-run it on your own window rather than trusting ours: the KuCoin candles endpoint needs no key and returns 1,500 minutes a call.
Compare what a gateway actually charges you
We track service fees, rate spreads, invoice windows, settlement models and KYC requirements for every processor in the directory, so you can price one against your real order sizes before you wire it into a checkout. NOWPayments publishes its fixed-rate pricing openly, which is more than most of the field does.
Compare Crypto Payment Gateways →FAQ
How much does the price move while a crypto invoice is open?
Less than most merchants expect. Across 43,185 overlapping 15-minute windows measured between 23 August and 22 September 2026, the median Bitcoin move was 0.084% and the average 0.128%. The 99th percentile was 0.686% and the single worst fall in the whole month was 2.26%. Ether, Solana, Litecoin, XRP and Dogecoin all ran higher than Bitcoin but stayed in the same range, with median moves between 0.116% and 0.174%.
Is a crypto payment gateway rate lock worth paying for?
On a short window, rarely. NOWPayments charges 1.5% for a fixed-rate payment against 1% for an ordinary one, so the lock costs half a percentage point. The average cost of not locking a 15-minute Bitcoin invoice, measured over 30 days, was 0.062%. That is roughly eight times cover for the risk. The ratio narrows on a volatile coin over a long window: an XRP invoice open for two hours carried 0.337% of expected exposure, which makes half a point closer to fair.
Why do crypto invoices arrive underpaid if the price barely moves?
Because the shortfall is almost never a price move. The customer's exchange deducts its withdrawal fee from the amount sent rather than adding it on top, and that fee is fixed while your invoice is not. We measured a 50 dollar invoice paid from a KuCoin Ethereum balance landing 11% short. Price movement breached a 1% tolerance on 0.11% of 15-minute Bitcoin windows. The fee is the cause about a hundred times more often than the market is.
What underpayment tolerance should a merchant set in 2026?
CoinGate allows up to 10% and recommends 1 to 2%, saying that range will most likely cover over 90% of orders that are accidentally underpaid. Our measurements support the recommendation but not the reasoning: a 1% band absorbs ordinary price movement on 99.89% of 15-minute Bitcoin windows, so almost all of the tolerance is being spent on exchange withdrawal fees instead. Set it from your customers' exchange fees at your smallest invoice size, not from a volatility forecast.
Do stablecoin payments remove exchange rate risk for merchants?
Effectively, yes, and at no cost. Over the same 30 days and the same 43,185 windows, USDC against USDT had a median 15-minute move of 0.000% and never moved more than 0.03% in either direction. Expected exposure on a 15-minute window was 0.0025%, about 25 times smaller than Bitcoin's and 200 times smaller than the price of a rate lock. Choosing the settlement asset removes more window risk than any paid feature does.
How long is the exchange rate locked on a crypto invoice?
It varies by gateway and is often two clocks rather than one. Verified on 22 September 2026: BitPay gives a fixed 15-minute payment window and marks an invoice invalid if the transaction has not confirmed within an hour. CoinGate expires an unselected order after 2 hours and a quoted one after 20 minutes. BTCPay Server defaults to 15 minutes and is adjustable per store. Cryptomus defaults to 3,600 seconds with a range of 300 to 43,200. NOWPayments freezes a rate for 10 minutes on its paid Fixed Rate option.
When does crypto price volatility actually cost a merchant money?
When a volatile coin sits in a long window. At 15 minutes, a 1% adverse move hit 0.11% of Bitcoin windows. Stretch the same test to two hours and it hits 2.48% of Bitcoin windows, 5.36% of Ether windows and 11.12% of XRP windows. CoinGate's unselected orders stay open for exactly 2 hours, so the risk is real at the top end of published windows even though it is negligible at the bottom.
- Crypto Invoice Expiry 2026: The 15-Minute Window Problem
- Crypto Payment Gateway Rates: The Spread You Pay
- Exchange Withdrawal Fees 2026: Why Invoices Arrive Short
- Minimum Crypto Payment 2026: Why Small Invoices Fail
- Crypto Payment Networks 2026: Which Chain to Accept
- Stablecoin Payments: The Merchant's Guide
Affiliate disclosure: payyd.co earns a commission on sign-ups made through our /go/ links, including the NOWPayments link above. We have no affiliate relationship with KuCoin, which appears here only as a price source, and none of the measurements were supplied by a gateway. Method, so you can repeat it: 43,200 one-minute closes per pair from KuCoin's public candles endpoint covering 23 August 2026 14:50 UTC to 22 September 2026 14:49 UTC, giving 43,185 overlapping 15-minute windows per asset; "expected loss" is the mean of the adverse move with rises counted as zero. Gateway figures are quoted from each company's own documentation, read on 22 September 2026; where two of a company's pages disagree we say so rather than choosing. Sources: BitPay invoice states, CoinGate order statuses, BTCPay Server store settings, Cryptomus invoice API, NOWPayments fees, Plisio invoice documentation, CoinGate on underpaid orders.