Zero Fees, Zero Trust: The NOWPayments Illusion

You think zero fees means free money. The truth is, it’s a centralized ledger that hands you the risk while promising convenience. NOWPayments just announced a “zero-fee, email-based crypto payment infrastructure.” The press release reads like a cure for enterprise gas pain. I read it three times, looking for the technical spec. I found none. Logic doesn’t require a whitepaper; it requires open-source code, audited contracts, and a clear trust boundary. This product offers none of those. Context: NOWPayments is an existing crypto payment gateway that processes over 50 cryptocurrencies. Their new feature lets businesses send payments to any email address — no wallet, no blockchain transaction fee, no on-chain confirmation. The recipient clicks a link, claims the funds, and the platform settles internally. The promise: instant delivery, zero gas costs, and automated payouts for affiliates, gaming rewards, or salary. The catch: every dollar sits in NOWPayments’ custodial account. You don’t own the keys. You own a promise. The core of this analysis is a systematic teardown of where the architecture fails — and where the marketing succeeds. First, the technical implementation remains undocumented. The press release says “under one second delivery” but never explains how. Is it an internal ledger? A state channel? A sidechain? Without a published spec, I default to the simplest explanation: a database. They keep a balance sheet. When a business deposits crypto, NOWPayments credits an internal account. When the business sends to an email, NOWPayments debits that account and credits the recipient’s internal account. The recipient can later withdraw to an external wallet, incurring a withdrawal fee. The “zero fee” only applies to the send operation, not the exit ramp. Greed is the feature; the bug is just the trigger. I applied the same forensic lens I used during the 2020 Compound interest rate analysis. I ran a mental stress test. Imagine a sudden price drop — 40% in an hour. Thousands of recipients rush to withdraw their stablecoins to external wallets. NOWPayments holds a pooled reserve. If the reserve is under-collateralized, withdrawals are delayed or denied. The platform becomes a bottleneck. You didn’t ask if the hidden cost is your principal, only if the gas was free. That is the classical trap of convenience over sovereignty. From a security perspective, this is a single point of failure. The team is anonymous beyond CEO Kate Lifshits — no LinkedIn trail, no prior payment industry track record. In my 2017 Ethereum testnet triage, I learned that code without known authorship is a liability. Here, the entire payment system is a black box. No audit report. No bug bounty. No proof of reserves. The tokenomic analysis is irrelevant because there is no token — the business model relies on transaction volume and presumably on interest from float or withdrawal fees. The sustainability of “zero fees” depends on hidden revenue streams. Either they cross-subsidize with other services or they plan to monetize user data. I don’t care about marketing spin; I care about incentive alignment. The regulatory exposure is severe. Email-based payments with minimal KYC are an anti-money laundering nightmare. In the US, a money services business must register with FinCEN, implement AML programs, and report suspicious activity. NOWPayments’ website says they perform KYC on business clients but not on individual recipients. That loophole invites abuse. I’ve seen this pattern before — the Axie Infinity bridge exploit started with an overlooked trust assumption. Here, the assumption is that email addresses are verifiable identities. They are not. Contrarian angle: I acknowledge the market need. Businesses with high-frequency, low-value payouts — affiliate networks, play-to-earn games, microtask platforms — are bleeding on gas fees and settlement delays. A centralized ledger that offers instant settlement at zero marginal cost is economically attractive. If NOWPayments maintains a large, auditable reserve and obtains proper licensing, it could serve a niche. The “email as identity” UX is clever for onboarding non-crypto users. I’ve seen similar solutions in legacy fintech (e.g., PayPal’s email payments). But PayPal was a regulated bank. NOWPayments is not. Takeaway: Would you trust a bank where the CEO is a name on a press release and the vault is a shared server? Neither would I. Zero fees are a marketing loss leader, not a technological breakthrough. The exploit wasn’t in the code; the code was never written. This is a product built on trust alone, in an industry that exists to eliminate trust. Until NOWPayments publishes an open-source implementation, a third-party security audit, and a proof of reserves, treat this as a high-risk experiment. The next time you see “zero fee,” ask: who holds the keys? The answer determines whether you’re using crypto or just a slower database.