About NextCryptoPay

NextCryptoPay is not an exchange and not a wallet provider. You paste in a receiving address or an extended public key (xpub) that you already control. Our system derives receiving addresses from that public key and reads public blockchain data to confirm payments — nothing more. We hold no private keys, so we have no technical way to move, freeze or refund your customers' payments. They travel directly from your customer's wallet to yours.

Four things we are regularly mistaken for, stated as plainly as we can:

• Not an exchange. We do not buy, sell, swap or convert crypto, and we offer no trading of any kind.
• Not a wallet provider. We never create a wallet for you, and we never generate or store a private key, seed phrase or mnemonic on your behalf.
• Not a custodian of payments. Your customers' payments never enter an address controlled by NextCryptoPay. There is no platform hot wallet in the payment path.
• Not a deposit-taking service. You cannot deposit customer funds with us, and there is no balance of customer money for us to hold.

1. 1You configure a wallet by giving us a receiving address or an extended public key (xpub). Both are public data: an xpub derives receiving addresses, but it mathematically cannot produce the private keys that spend from them.
2. 2When you create an invoice, we derive the next receiving address from your own public key and show it on the checkout page. That address belongs to your wallet, not to us.
3. 3Our workers read public blockchain data — the same data behind Tronscan, BscScan, Etherscan and mempool.space — and wait for the payment to appear and confirm.
4. 4We notify your server with an HMAC-SHA256 signed webhook. At no point does any code in the platform build, sign or broadcast a blockchain transaction.

We do not publish the identity of the people who operate NextCryptoPay, and we are not going to pretend otherwise. There is no company name, no registration number and no office address on this site, because there is no legal entity to name. You should factor that into your risk assessment before you route real revenue through any service — including this one.

What we offer instead of a name is a design where our identity does not need to matter: we never hold a key that can move your money, so there is nothing for an anonymous operator to run away with. Everything below is stated so that you can check it yourself rather than trust us.

• Paste an xprv (a private key) into the wallet form and it is refused, not stored. The guard accepts only extended keys that carry no private material.
• If the platform's own fee wallet were ever configured with a private key instead of a watch-only public key, the service refuses to start. In production, the same startup check also rejects any environment variable holding a private key, mnemonic or seed phrase.
• An automated test asserts both of those guards on every build, so the property cannot be quietly removed in a later release.
• Look your own receiving address up on Tronscan, BscScan, Etherscan or mempool.space. You will see the payment arrive from your customer straight into your address, with no hop through anything we control.

Read the full security model →

nextcryptopay.com is our only official domain. We operate no other domain and no mobile app, and the only support channels we use are the ones linked from that domain and from inside your dashboard — treat any other site, app, chat group or account claiming to be NextCryptoPay as fake. We are not affiliated with Cryptopay.me, getcryptopay.com, the CryptoPay WordPress plugin or any other similarly named service. We will never message you asking for a private key or a seed phrase, and we will never ask you to send funds to an address other than the wallet you configured yourself.

There is exactly one place where NextCryptoPay receives USDT, and it is not your customers' money: the prepaid balance you top up to cover our platform fee. That is our revenue, paid in advance by you, and it is completely separate from the payment flow between your customer and you. We would rather state this exception ourselves than let you find it later and wonder what else we left out.

General and integration questions: [email protected]. Security reports: [email protected]. To report a merchant misusing the service: [email protected]. We read every message, and we answer as an independent project, not a support department.