> ## Content Index > Fetch the complete content index at: https://coti.io/blog/llms.txt > Use this file to discover other available public pages before exploring further. # Paying for a VPN With Crypto: What It Hides and What It Doesn't - URL: https://coti.io/blog/paying-for-a-vpn-with-crypto-what-it-hides-and-what-it-doesnt/ - Published: 2026-10-06T11:14:30.000Z - Updated: 2026-10-06T11:14:30.000Z - Description: A VPN changes who sees your traffic. Paying in crypto changes who knows you're a customer. Neither does the other's job, and both leave gaps worth knowing. - Author: Antonio - Tags: Privacy Paying for a VPN with crypto can keep your name and card number out of the VPN provider's billing records, but it doesn't make the VPN private and it doesn't hide the payment itself. Two separate things are happening: the VPN changes who sees your internet traffic, and the crypto payment changes who knows you're a customer. This guide separates the two, using the providers' own policies and guidance from the EFF and the US Federal Trade Commission, so you know which gaps each one closes. *Current as of October 6, 2026.* ## The Short Answer **What a VPN hides** - Your browsing from your internet provider and the local Wi-Fi, which see only an encrypted connection to the VPN - Your home IP address from the websites and wallet nodes you connect to **What a VPN doesn't hide** - Your browsing from the VPN provider itself, which now sees what your internet provider used to see - Logins, cookies and browser fingerprints - Your real IP address, if the connection leaks **What paying in crypto hides** - Your card number and bank details, which never touch the transaction **What paying in crypto doesn't hide** - The payment itself, which on transparent chains like Bitcoin and Ethereum is public - The link between your coins and the exchange that verified your identity - Whatever a third-party payment processor collects at checkout ![Two-column chart comparing what a VPN changes (internet provider, websites, the VPN provider, leaks) with what paying in crypto changes (card issuer, the VPN provider or processor, the blockchain, the exchange), above a note that neither hides logins, cookies or browser fingerprints](https://coti.io/blog/content/images/2026/10/pay-for-vpn-with-crypto_ASSET_2.webp) What a VPN and a crypto payment each change. Sources: EFF, US FTC, Consensys, IETF RFC 8828, Mullvad and IVPN privacy pages, BitPay, Bitcoin whitepaper, EU Regulation 2023/1113\. As of October 6, 2026. ## What a VPN Actually Changes A VPN sends your traffic through servers run by the VPN provider. To the websites you visit, your connection appears to come from the VPN's server rather than from your home or phone, which is why the EFF's [Surveillance Self-Defense guide](https://ssd.eff.org/module/choosing-vpn-thats-right-you?ref=coti.io), last reviewed July 28, 2026, says a VPN masks your IP address and makes your location look like the server's location. The other change is local. The EFF says a VPN hides your outgoing traffic from your internet provider and from whoever runs the network you're on, like a café or a hotel. That matters less than it used to, because the EFF also notes that the majority of web traffic is now encrypted with HTTPS anyway. For crypto users, the IP change has one specific use: the node your wallet talks to sees the VPN's address instead of yours. [Consensys has said](https://consensys.io/blog/privacy-policy-update?ref=coti.io) that an RPC provider such as Infura receives your IP address and wallet address when you send a transaction, so a VPN changes which IP address it sees. None of this removes trust. It moves it. As the US Federal Trade Commission [put it](https://www.ftc.gov/business-guidance/blog/2018/02/market-vpn-app?ref=coti.io) in a 2018 business guidance post, a VPN app "just shifts trust from those networks to the VPN app provider." ## What a VPN Doesn't Hide ### The VPN provider sees what it carries Everything your internet provider used to see, such as which sites you connect to and when, the VPN provider now sees. The EFF is blunt about it: whoever runs a commercial VPN will see your traffic, VPN providers are subject to law enforcement requests, and many save as much information as internet providers do. The FTC adds that using a VPN app gives it permission to intercept all of your internet traffic. ### Logins, cookies and fingerprints still identify you A VPN changes your IP address, not your identity online. The EFF lists other ways companies can still track you, including cookies, tracking pixels and fingerprinting. The EFF's [Cover Your Tracks](https://coveryourtracks.eff.org/learn?ref=coti.io) project defines a browser fingerprint as a list of characteristics unique to you, your browser and your hardware setup, built from more permanent identifiers such as hardware specifications and browser settings. And the moment you log into an account or type your email into a form, the FTC notes, the site can track you through what you just handed over. ### Leaks can expose your real IP A VPN only protects traffic that actually goes through it. The UK's National Cyber Security Centre [notes](https://www.ncsc.gov.uk/collection/device-security-guidance/infrastructure/virtual-private-networks?ref=coti.io) that only traffic routed over the VPN is protected. Two documented weak spots: - **WebRTC**, the browser technology behind video calls. The IETF standard [RFC 8828](https://www.rfc-editor.org/info/rfc8828/?ref=coti.io), published January 2021, explains that with a split-tunnel VPN, WebRTC can discover both the VPN's address and the real internet address underneath it. - **IPv6**. The IETF's [RFC 7359](https://www.rfc-editor.org/info/rfc7359/?ref=coti.io) documents how traffic meant for a VPN tunnel can leak out in the clear on networks that support both IPv4 and IPv6, when the VPN software doesn't handle IPv6. ### What you can do about it - Choose a VPN app that routes all traffic through the tunnel rather than splitting it, which is also the NCSC's advice. - Check that the VPN app handles IPv6 traffic, or that IPv6 traffic can't bypass it. - Keep browsing you want separated in a separate browser profile, logged out of your usual accounts. - If you need stronger protection than a VPN gives, the EFF points to Tor, because no single Tor server can see your browsing data. ## What Paying With Crypto Changes Card payments tie your VPN account to your name. The EFF points out that most commercial VPNs require a credit card, which can easily be linked back to your identity. Paying in crypto takes your card issuer and bank out of the picture. Some providers go further and skip the account details entirely. Mullvad's [no-logging policy](https://mullvad.net/en/help/no-logging-data-policy?ref=coti.io), last updated June 17, 2026, says it asks for no username, password or email and generates a random account number instead. IVPN's [privacy policy](https://www.ivpn.net/en/privacy/?ref=coti.io) says it doesn't ask for personal information such as an email address or name at sign-up. Mullvad says it runs its own full node for each cryptocurrency it accepts and hosts its own wallets, with no third parties involved. IVPN says Bitcoin payments go through a BTCPay payment server it runs itself. ## What Paying With Crypto Doesn't Hide ### The provider still keeps a payment record Even account-less providers record payments. Mullvad's policy says the record of a crypto payment holds the amount, currency and a timestamp (cut down to the date after 20 days), plus the unique receiving address for Bitcoin and Bitcoin Cash payments, which is removed after 20 days. For Monero payments, it keeps the transaction hash beyond 20 days to prevent double-crediting. IVPN lists a payment ID, account ID, amount, currency, timestamp and transaction ID. ### A payment processor may collect more Some VPNs don't handle crypto themselves. They use a payment processor, and the processor's own policy then applies to you. BitPay's [privacy policy](https://www.bitpay.com/about/privacy?ref=coti.io), last updated January 10, 2026, says that when you pay an invoice it collects the IP addresses used to view the invoice, your email address and your crypto wallet address. CoinGate's [privacy policy](https://coingate.com/policy/privacy-policy?ref=coti.io), updated August 2026, lists data including IP address, crypto addresses and transaction details, and, for anti-money-laundering checks, a payer's email, name, date of birth and country of residence where the law requires them. Before you pay, check whether checkout runs on the provider's own setup or on a processor, and read that processor's policy too. ### The payment is public on-chain On transparent chains such as Bitcoin and Ethereum, the payment itself is permanent and visible. The [Bitcoin whitepaper](https://bitcoin.org/bitcoin.pdf?ref=coti.io) describes the design: the public can see that an amount moved from one address to another, without a name attached. On Ethereum, a block explorer like Etherscan shows [every incoming and outgoing transaction](https://info.etherscan.com/explore-eoa-address/?ref=coti.io) for any address. The provider knows its own receiving address, so it can look up the address that paid it, along with that address's balance and history. ### Your exchange can still link the coins to you If you bought the coins on a regulated exchange, that exchange can link them to your verified identity. In the EU, the [Transfer of Funds Regulation (EU) 2023/1113](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1113&ref=coti.io) has applied since December 30, 2024 (Article 40), and its Article 14(5) requires crypto-asset service providers, such as exchanges, to obtain and hold sender and recipient information even when you withdraw to your own wallet. The crypto payment keeps your card off the bill. It doesn't erase where the coins came from. ### The provider may still see your IP The EFF notes that even if you use an alternative payment method, the VPN provider may still collect your IP address when you use the service. Paying privately and connecting privately are separate problems. ## How to Judge a VPN's Privacy Claims No-logs promises are easy to write and hard to check. The EFF's advice is short: "a claim is not a guarantee, so be sure you verify these claims." Its checklist: - **Read the privacy policy, not the homepage.** The EFF warns that a VPN company might log your data if its privacy policy doesn't specifically rule it out. - **Look for published third-party audits.** The EFF calls them a sign the provider takes security seriously, while noting there's no certainty practices don't change after the audit. - **Check for transparency reports**, which show whether a provider has received government requests for data, **and for press coverage**, which can show whether it has misled customers before. - **Be wary of free VPNs.** The FTC says many are free because they sell in-app advertising or share your information with third parties. The same FTC guidance cited researchers who studied almost 300 VPN apps and found that some didn't use encryption and some shared data with third parties. ## Where COTI's VPN Fits COTI is building a VPN as part of the COTI app, alongside travel booking and a card (the app, travel booking and virtual card betas are also planned for Q4 2026 on the roadmap, as of October 6, 2026). On [coti.io](https://coti.io/?ref=coti.io#vpn), COTI describes it as a VPN you can use without creating an account, with subscriptions paid in COTI. **Status:** planned. According to the roadmap published on [coti.io](https://coti.io/js/roadmap-data.js?ref=coti.io) as of October 6, 2026, the VPN beta is planned for Q4 2026, the full launch and a browser extension for Q1 2027, and a regional server expansion for Q3 2027. The details that will decide how private it is in practice haven't been published yet: its privacy policy, any independent audit, and how payments in COTI for subscriptions will work on-chain. COTI hasn't said on coti.io or in its docs whether VPN payments will use its private tokens. If they do, COTI's [Privacy-on-Demand documentation](https://docs.coti.io/coti-documentation/privacy-on-demand/what-is-privacy-on-demand?ref=coti.io) and its [September 1, 2026 explainer](https://cotinetwork.medium.com/privacy-on-demand-how-privacy-works-across-chains-151f267973f7?ref=coti.io) say its privacy encrypts amounts and balances, not the fact that a transaction happened. Apply the same checklist above when it launches, and we'll update this guide when those details are out. ## Frequently Asked Questions ### Is paying for a VPN with Bitcoin private? Partly. It keeps your card and bank out of the payment, and some providers don't ask for an email either. But a Bitcoin payment is recorded on a public blockchain, the provider keeps its own payment record, and if the coins came from an exchange that verified you, the trail can lead back to your identity. ### Does a VPN hide my crypto transactions? No. A VPN hides your IP address from the node your wallet connects to, but the transaction itself is still recorded on the blockchain. One way to hide amounts on-chain is confidential tokens, such as those on COTI's [Privacy Portal](https://docs.coti.io/coti-documentation/coti-privacy-portal?ref=coti.io) (live, per COTI's docs as of October 6, 2026), and even those keep the fact of the transaction visible. ### Do I still need a VPN if websites use HTTPS? It depends on what you want hidden. HTTPS already encrypts the content of most web traffic. The EFF notes that HTTPS doesn't protect metadata, such as which sites you connect to, and that a VPN can hide that from your local network, but the VPN provider then sees all of it. ## Where to Go From Here A VPN and a crypto payment solve different problems, and the best setup uses each for what it actually does: the VPN for your traffic, a careful payment for your billing, and good browser habits for the rest. If you want to follow COTI's planned VPN, part of the COTI app, [join the waitlist on coti.io](https://coti.io/?ref=coti.io#invite) and watch for the VPN beta planned for Q4 2026. *Details checked October 6, 2026\. Product features, roadmap dates and provider policies can change. Nothing here is financial or legal advice, and no VPN provider named here is endorsed or affiliated with COTI. COTI will never ask for your seed phrase or private key, and announcements only come through coti.io, docs.coti.io and COTI's official channels.* ## Sources - [Choosing the VPN That's Right for You](https://ssd.eff.org/module/choosing-vpn-thats-right-you?ref=coti.io), EFF Surveillance Self-Defense, last reviewed July 28, 2026, accessed October 6, 2026 - [In the market for a VPN app?](https://www.ftc.gov/business-guidance/blog/2018/02/market-vpn-app?ref=coti.io), US Federal Trade Commission, published February 22, 2018, accessed October 6, 2026 - [Learn: Cover Your Tracks](https://coveryourtracks.eff.org/learn?ref=coti.io), EFF, accessed October 6, 2026 - [Virtual private networks](https://www.ncsc.gov.uk/collection/device-security-guidance/infrastructure/virtual-private-networks?ref=coti.io), UK National Cyber Security Centre, reviewed May 13, 2025, accessed October 6, 2026 - [RFC 8828: WebRTC IP Address Handling Requirements](https://www.rfc-editor.org/info/rfc8828/?ref=coti.io), IETF, published January 2021, accessed October 6, 2026 - [RFC 7359: Layer 3 Virtual Private Network Tunnel Traffic Leakages in Dual-Stack Hosts/Networks](https://www.rfc-editor.org/info/rfc7359/?ref=coti.io), IETF, published August 2014, accessed October 6, 2026 - [Consensys Privacy Policy Update](https://consensys.io/blog/privacy-policy-update?ref=coti.io), Consensys, published November 24, 2022, accessed October 5, 2026 - [No-logging of user activity policy](https://mullvad.net/en/help/no-logging-data-policy?ref=coti.io), Mullvad, last updated June 17, 2026, accessed October 6, 2026 - [Privacy policy](https://www.ivpn.net/en/privacy/?ref=coti.io), IVPN, accessed October 6, 2026 - [Privacy Policy](https://www.bitpay.com/about/privacy?ref=coti.io), BitPay, last updated January 10, 2026, accessed October 6, 2026 - [Privacy Policy](https://coingate.com/policy/privacy-policy?ref=coti.io), CoinGate, last updated August 2026, accessed October 6, 2026 - [Bitcoin: A Peer-to-Peer Electronic Cash System](https://bitcoin.org/bitcoin.pdf?ref=coti.io), Satoshi Nakamoto, published October 31, 2008, accessed October 5, 2026 - [Explore an EOA Address on Etherscan](https://info.etherscan.com/explore-eoa-address/?ref=coti.io), Etherscan Information Center, published December 31, 2019, accessed October 5, 2026 - [Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1113&ref=coti.io), EUR-Lex, published June 9, 2023, accessed October 5, 2026 - [COTI VPN](https://coti.io/?ref=coti.io#vpn), coti.io, accessed October 6, 2026 - [COTI roadmap data](https://coti.io/js/roadmap-data.js?ref=coti.io), coti.io, accessed October 6, 2026 - [What is Privacy-on-Demand](https://docs.coti.io/coti-documentation/privacy-on-demand/what-is-privacy-on-demand?ref=coti.io), COTI, accessed October 6, 2026 - [Privacy-on-Demand: How Privacy Works Across Chains](https://cotinetwork.medium.com/privacy-on-demand-how-privacy-works-across-chains-151f267973f7?ref=coti.io), COTI, published September 1, 2026, accessed October 5, 2026