Security and the non-custodial model

• It can derive receiving addresses from a public key you supply, and show them on a checkout page.
• It can read public blockchain data and decide that an invoice has been paid.
• It can notify your server with a signed webhook and record order state in its own database.

• It cannot move, freeze, reverse or refund a payment, because it holds no key that can sign a blockchain transaction. That is an architectural property, not a policy we promise to follow.

A payment processor can only move funds if it holds a key that can sign transactions. We hold none. When you configure a wallet you give us either a receiving address or an extended public key (xpub). Both are public data. An xpub can derive receiving addresses, but it mathematically cannot produce the private keys needed to spend from them. Our workers call read-only blockchain endpoints — the same public data behind Tronscan, BscScan and mempool.space — and no code path in the platform constructs, signs or broadcasts a transaction that spends merchant funds.

• The wallet-configuration endpoint rejects any extended key that contains private material — paste an xprv and it is refused, not stored.
• The platform's own fee wallet is subject to the same rule in every environment: the service refuses to start if that wallet is configured with a private key instead of a watch-only public key.
• In production, startup validation additionally aborts the process if any environment variable holds a private key, mnemonic or seed phrase.
• The on-chain workers use read-only data adapters. There is no transaction signing or broadcasting code in the platform.
• An automated test asserts that both key-entry points reject private keys, so the invariant cannot be silently removed in a later release. And marking an order refunded in the dashboard changes a database record — it does not and cannot move any coins.

There is exactly one place where NextCryptoPay receives USDT, and it is not your customers' money: the prepaid balance you top up to pay our platform fee. That is our revenue, paid in advance by you, and it is completely separate from the payment flow between your customer and you. The fee-collection wallet is configured watch-only in our infrastructure, which is exactly why the service refuses to start if a private key is supplied for it. We would rather state this exception ourselves than let you discover it and wonder what else we left out.

See the current fee on the pricing page →

• What an attacker could obtain: merchant account data, configured receiving addresses and xpubs, order metadata, webhook endpoints and webhook secrets. They could serve wrong receiving addresses on future checkout pages.
• What an attacker could not obtain: your funds, or any past payment. There is no key in our systems that can spend from a merchant wallet, so there is nothing to steal from the balances themselves.
• What this means for you: verify the receiving address shown on checkout against the wallet you configured, and verify every webhook signature before acting on it.

Take the wallet address you configured and look it up on a public block explorer — Tronscan for TRC-20, BscScan for BEP-20, Etherscan for ERC-20, mempool.space for Bitcoin. You will see the payment arriving from your customer's address directly into yours, with no intermediate hop. If any address we control ever appeared in that path, it would be visible right there. It does not.

• We cannot reverse or refund a payment. On-chain transactions are final. A refund is something you send yourself, from your own wallet; our dashboard only records that you did.
• We cannot recover funds sent to a wrong address. If the wallet address you configured is wrong, payments go to that wrong address and they are gone. Check the address, and test with a small amount first.
• We cannot recover your wallet. We never had your keys. If you lose them we cannot help — no support channel, no exception.
• We cannot freeze or seize funds, including at your own request or a third party's. We have no such capability.

NextCryptoPay has not undergone a third-party security audit, and we are not going to imply otherwise. We also do not publish the identity of the people who operate it: there is no company name, registration number or office address on this site, because there is no legal entity to name. You should weigh both facts before routing real revenue through any service, including this one. What we offer instead of a name and a certificate is a design where our identity does not need to matter — we never hold a key that can move your customers' money, and every claim above is the kind you can test rather than trust.

Send findings to [email protected], or see our reporting policy below. We confirm receipt and keep you updated on the fix. Please do not test against live merchant invoices or other people's payments.

/.well-known/security.txt