Securing bitcoin addresses in database
If an attacker has write access to your database without you noticing immediately, it's pretty much Game Over.

Say you are actually able to secure the payout address field from tampering, then the attacker could still overwrite the password field with his own hash, log in as the user and change the payout address through the "allowed" way.

You should not worry too much about this scenario, but rather make sure no one will get direct access (read or write) to your database in the first place: Use prepared statements, grant minimum required access, harden your servers, etc.