diff --git a/modules/rfunds/mod.ts b/modules/rfunds/mod.ts
index aafe5b6..d5c0c4b 100644
--- a/modules/rfunds/mod.ts
+++ b/modules/rfunds/mod.ts
@@ -155,7 +155,8 @@ routes.get("/api/transak/config", (c) => {
 });
 
 routes.post("/api/transak/webhook", async (c) => {
-	const rawBody = await c.req.text();
+	// Clone request so we can read body twice (once for HMAC, once for JSON)
+	const rawBody = await c.req.raw.clone().text();
 
 	// HMAC verification — if TRANSAK_WEBHOOK_SECRET is set, validate signature
 	const webhookSecret = process.env.TRANSAK_WEBHOOK_SECRET;
@@ -169,7 +170,8 @@ routes.post("/api/transak/webhook", async (c) => {
 		}
 	}
 
-	const body = JSON.parse(rawBody);
+	let body: any;
+	try { body = rawBody ? JSON.parse(rawBody) : await c.req.json(); } catch { return c.json({ error: "Invalid JSON" }, 400); }
 	const { webhookData } = body;
 
 	// Ack non-completion events (Transak sends multiple status updates)