The app was never designed. It was a revenue stream.
Measured by a single number, total transaction volume, MoonPay's app could only ever reward one thing: the next transaction. MoonPay owned the ramps, the rails that turn ordinary money into crypto and back, and the app was just one more place to run them. Nobody asked what it should be, so it became what the metric rewarded. Every affordance is a transaction: buy, sell, swap, top up. Nothing exists to do more, no understanding, no readiness, nothing beyond moving you toward the next purchase.
And it wasn't even doing that one job well. You could see it the moment a customer finally decides to act, price moving, mind made up. A trading product is judged right there, and MoonPay met it with a wall: verify your identity, add a card, in the UK wait out a 24-hour cooling-off period. The onboarding they thought was behind them was still running, at the point of peak intent. The single biggest drop-off in the entire funnel sat right there.
Coinbase wasn't winning on custody
Its real advantage was structural: nothing in the product forced every interaction toward a single transaction. Everyone at MoonPay thought Coinbase won because it held your crypto for you, simpler, less for the customer to manage. That freedom to not be a checkout is what let them build around the opposite idea: getting you ready. The same hurdles MoonPay piled onto the moment of intent, identity, payment, a funded balance, Coinbase spread calmly ahead of time. Same friction, redistributed. By the time you decided to act, the work was already done.
The ramp was a juggernaut. The app couldn't breathe.
The app couldn't become more than a checkout, because it ran on infrastructure built to be one. MoonPay's ramp was the most successful in crypto for the better part of a decade, and the two are easy to conflate. The promise that won its partners was that it handled everything: identity, compliance, payments, delivering the crypto itself. That same promise is why it became a monolith, one system owning the whole journey end to end. The app ran on it like any other partner, so every hurdle was welded to the purchase. You couldn't pull a single piece out and shape it. Bound to the monolith, the app could only ever be a crypto ATM.
Break the ramp apart
The fix wasn't subtle: break the monolith into its capabilities, each one able to stand alone, outside a purchase. The moment identity, payments, and the wallet can each be used on their own, the app stops being a wrapper around a checkout. You can get people ready ahead of time, build a real product instead of a till. And this wasn't a leap into the unknown. I'd always designed in kits, an identity kit, a payments kit, a wallet kit, reused across the on-ramp and the off-ramp, because an off-ramp is just an on-ramp inverted. The capabilities were already clean, separable pieces in my design files. The monolith was the anomaly, not the decomposition. I called them blocks.
What a block is
A block follows four rules:
- One job. One capability at a time, nothing more.
- Works outside a purchase. Invoked on its own, then gone, not just mid-transaction.
- A step, or a whole journey. Stands alone, or chains into a longer flow.
- Agnostic, yet conforms. Neutral enough to serve any product, themed enough to feel native in each.
The first three are mechanical. The fourth is the hard one. Every block had to be deliberately neutral, because the same piece served lots of different products, and neutral sits dangerously close to generic. The craft was making something agnostic still feel like it belonged the instant it landed in a specific host, taking on its look and behaviour, never reading as foreign. And because each block is built once, every product that uses it inherits it. Improve the block, and everything it lives in gets better at once.
One capability at a time.
The bet I drove
Engineering had wanted to break the monolith for years. It never got greenlit, because nobody had made it safe to bet the $2B flow on. I built the plan that did. The unlock wasn't the architecture, it was the sequencing. The monolith never stops serving: each new block gets injected into the live on-ramp, one at a time, and proven in the real flow before the next one starts. We began with authentication. It needed the work anyway, and it sits at the start of a journey, not the middle, so it was reversible and low-risk. Auth was live in about three months. The other half was framing. Engineering had always pitched the rebuild as tech debt, and tech debt loses every roadmap fight. I sold it as what it actually unlocked: the flexibility to finally build a real consumer product. That is what I took to the VP of Product, and a rebuild stalled for years became the company's number-one priority for 2024. Then I drew the org frame that made it stick: one owner per block, because nothing improves until someone owns the thing that has to.
Not an embedded page. A native citizen of the OS.
The hardest part of the rebuild wasn't how a block looked. It was how it felt. A block had to feel like it was always part of the host, which means it can't behave like an embedded webpage. It has to behave like a native citizen of the operating system. So I designed an engine for exactly that: the shell. It appears, tracks the keyboard, pushes between views, scales up when a third-party SDK needs the full screen, then shrinks back to a confirmation. The discipline was restraint: invisible until the moment earns it. And it re-skins to any brand, so the block never reads as a guest.
In the real product, both sides start in the same app, with the same tap. The old way threw you into a full-screen Safari webview, the browser chrome, the wait, the certainty you'd left. The new way, the block just rises in place, native and keyboard-aware, never leaving for a second. Same screen, same job, two different products. The only thing that changed is how it's presented.
One system underneath
Under every block was a design system I built from scratch, Orion: MoonPay's first properly codified system for mobile. It defined what every block was made of, and the app and all the new block infrastructure were built from it. One codebase, one stack, a level-up from the fragmented mess that came before. And it was cross-platform by design: React Native where a block ran natively in our app, web where it had to live inside a partner's product. One system, both worlds. That's what let a block feel native in our app and still drop cleanly into someone else's.
Do the hard work before the moment
The whole game was moving the friction-heavy steps out of the purchase and ahead of it, so they happened calmly, when nothing was at stake. Take identity. In the old world, verification lived inside the buy, so you hit it mid-transaction with the price moving, the worst possible moment. We pulled it out: verify once, calmly, and never think about it again. The problem was never the verification, it was the timing. And because one team finally owned identity as its own product, they could actually make it better. Payment moved the same way: add a card or top up a balance, decoupled from any purchase. A funded balance turned out to be the strongest intent signal in the product. If you'd topped up, you'd already parted with the money and parked it, ready to move the instant the price felt right. That is a spend-ready customer, and now we could see exactly who they were.
So buying is two taps
Account, wallet, payment, identity, all handled ahead. So when the moment finally comes, buying is two taps. One fluid flow that never throws a wall in your face. Blended conversion on the consumer app went from around 17% to north of 40 in some markets. But the conversion was never the real prize, and it didn't come from faster ramps. Breaking the monolith apart let us build a real onboarding narrative, one that got people spend-ready before they ever tried to buy. The conversion came from people arriving at the moment already prepared for it. For the first time, MoonPay could try to be a real product. Not a crypto ATM.
Every block got better on its own
Because each capability finally had a single owner, it could improve in isolation, and every surface that used it inherited the result. Fix something once at the block, and it's fixed everywhere the block appears. Three that paid off fastest:
- Authentication. The same designer and PM kept shipping it. They reframed duplicate accounts from "users failing the funnel" into a correctness problem, and cut duplicate account creation 30% in two quarters.
- Identity. With KYC pulled out of the transaction and one team owning it end to end, pass rates rose 15% and enhanced due diligence dropped from two months to under 48 hours.
- Payments. Design-led from day one. The owner built one pattern instead of four one-offs, serving PayPal, Venmo, balances, and Revolut Pay. On-ramp conversion lifted ~20% in some markets.
None of these were Blocks. They were what Blocks made possible.
Once it wasn't a wrapper, we could build anything
The real shift was mental. Once the app wasn't a wrapper, the question stopped being what the tech would allow and became what the product should be. Across 2025 the thinking moved fast, and you can see it in what got built:
- Trading and discovery, so people had a reason to explore, not just buy.
- Onboarding that gets you ready, instead of dropping someone on a dead screen.
- Ways to earn a return on what you hold, a reason to stay.
- More delightful wallet surfaces across the product.
Construct after construct, at a pace the old monolith would never have allowed. None of it was possible before. The technology stopped being the thing holding us back and became the thing we built from.
The same unlock, for everyone building on us
Once I'd built the spend-ready pieces for our own app, I realised every wallet that embedded MoonPay was trapped in the exact same monolith we'd just escaped. They were renting the same rigid checkout, hitting their own customers with the same wall at the same worst moment. And because every block stood alone and conformed to any brand, we could hand them the same unlock: let their customers verify, fund, and get spend-ready inside their product, in their own skin, without ever touching our monolith. A handful of partners had begged us for exactly this for years, when they said "just give us the APIs." They were asking for headless before the word existed. The work I've walked through is the foundation MoonPay's headless product runs on today. The ceiling didn't just lift for us. It lifted for everyone building on us.
The principle
You can't craft your way past a bad foundation. The ceiling on great work was never my team's talent. It was what they had to build on. When a solution comes out less than perfect, the instinct is to push the designers for more polish. That's almost always the wrong place to look. More often, people are hacking around a limit they've quietly accepted as fixed. My team had all the craft they needed. What they were up against was a monolith that capped how good the work could ever be.
So the highest-leverage craft decision a design leader makes usually isn't in the design at all. It's whether the team's talent has somewhere to go. Break the ceiling, and you'd be amazed what they build.
