How to buy a no-KYC VPS with crypto and leave almost nothing to hand over

Legal hygiene: which mail, which VPN, which coin, and how to harden the box so a no-KYC crypto VPS or dedicated server stays a string, not a name.

Published 2026-08-30 · Updated 2026-10-21 · BitCloudVPS Editorial

What this is — and is not

This is how to buy a VPS with crypto, or buy a dedicated server with Bitcoin or USDT, so the file on our side does not name you. It is for lawful privacy: journalists, operators, people who do not want a card processor or a passport in the hosting stack. It is not a crime manual. CSAM, phishing and paid attacks stay prohibited. Offshore and no-KYC do not cancel physics or your own mistakes.

What BitCloudVPS actually keeps

We do not KYC. We do not take cards. We do not run AML checks on coins. We do not screen wallets with chain-analysis products. We do not store a name, phone, selfie or home address. The leftover is small: an email string, a password hash, and the invoice needed to mark the payment (amount, coin, address, transaction ID). Connection metadata is kept at most 24 hours. We do not keep payload logs. If a letter arrives from a jurisdiction that is not ours, that letter is not a reason to grow the file. A US form letter is not a kill switch and not a discovery request we volunteer extra data for.

The job of this guide is to make that leftover non-identifying. If the inbox is your Gmail and the coin left a KYC exchange, we still only have an email and a txid — but those two strings point at you. Buy a no-KYC VPS with crypto only after you pick an inbox and a wallet that do not.

Which email to use

The address must receive one SSH mail and later invoices. That is the only reason we ask for it. Do not use Gmail, Outlook or iCloud if the point is to keep a name off the account. Use a mail host that does not demand a selfie: Proton Mail, Tuta Mail, or mailbox.org. SimpleLogin gives you an alias in front of an inbox so the string we store is not your long-lived address. 1984 Hosting sells mail in Iceland if you want the same jurisdiction story as a Reykjavik VPS.

How to open the checkout

Do not place the order from a home or office ISP if that IP is the thing you are trying not to write down. Open Tor Browser or a no-account VPN such as Mullvad VPN (they sell accounts for cash or crypto and do not want an email). IVPN is the same class. Do not check out through a corporate VPN that SSO-logs your name. Do not use the same consumer VPN account you bought with a card and a real name if that trail is in scope.

A second pattern: buy a cheap no-KYC VPS with crypto first (Starter), put WireGuard official site on it from WireGuard quick start, then buy the real VPS or dedicated server through that tunnel. That is two invoices and two emails if you want isolation. We do not require it.

How to pay so the coin does not name you

Send from a wallet you control. Do not withdraw from a KYC exchange straight to our invoice address: the exchange then has our deposit and your passport. Bisq is a public P2P path some people use so the purchase of the coin is not an exchange KYC file. USDT and BTC work on the same page. We do not AML-score the incoming coin. We do not ask where the wallet lived.

After the box is up

We rent root. Anonymity after deploy is your sshd, not our panel. Follow OpenSSH manual: key-only login, no PasswordAuthentication, no root password over the network. Generate the key on a machine that is not your named work laptop if that is the model. Do not upload that key to GitHub. Disable password auth before you publish a service. Put WireGuard official site on the VPS first if you want admin access off the public SSH port. Do not put your legal name in the hostname, motd, TLS CN or WHOIS. A personal domain with real-name WHOIS undoes a no-KYC VPS paid in crypto.

Dedicated is the same hygiene plus IPMI: reach IPMI only through the VPN we document, not from a cafe on a named laptop. Buy a dedicated server with crypto on the same account if you need exclusive cores; the leftover file is still email plus invoice.

What we will not invent later

We do not add KYC after a spend threshold. We do not start AML-scoring wallets because a foreign office emailed. We do not keep a second shadow profile. The best-case compelled file is: this email string paid this invoice for this SKU in this datacenter. If that email and that coin are not tied to a name, there is no name to type. That is the whole design of a no-KYC crypto VPS and of offshore dedicated servers paid in cryptocurrency. It is still not a promise that you are invisible on the public internet.

Prerequisites checklist before you click deploy

The checkout asks nothing that identifies you - signup works with a token only, email is optional, and the 19-asset payment rail never touches a card network - so everything that could attach a name to your server enters through choices you make yourself. Get those choices right before the deploy button, because they are cheap before the invoice and awkward after.

Two habits complete the checklist. First, separate identities: the keypair, hostname and DNS account for this server should not reuse anything from a server tied to your name. Second, decide the renewal story in advance - a term long enough to outlast your attention span is itself an opsec control, because the failure mode of anonymous accounts is not discovery but abandonment. If you plan to pre-fund a wallet balance, the bonus tiers at $1,000 (+10%) and $2,000 (+40%) are there, and they change nothing about what the account holds: still just a token and a balance.

First ten minutes on the box: hardening sequence

A fresh VPS comes with a root shell about 60 seconds after payment clears. What you do in the next ten minutes determines whether the anonymity at the checkout survives the server's exposure to the internet.

1. Log in once with the delivered credentials, immediately create your own user, and install your fresh public key: ssh-copy-id user@your-ip.
2. Disable password authentication for SSH: set PasswordAuthentication no and PermitRootLogin no in /etc/ssh/sshd_config, then systemctl reload sshd. Verify the new session works before closing the old one.
3. Move SSH off port 22 if the box is long-lived and quiet - not security, but it cuts scanner noise by an order of magnitude and makes the auth log readable.
4. Apply pending package updates: apt update && apt full-upgrade (or the distro equivalent). Fresh images age in a queue.
5. Bring up a host firewall with default-deny inbound: ufw default deny incoming && ufw allow 22 && ufw enable, then open only what each service needs. DDoS scrubbing at L3/L4 is on the network side; the firewall is yours.
6. Check what the box announces: hostnamectl set-hostname mail.example.org and, if you will send mail, set the matching PTR per our rDNS guide. A generic hostname on a clean IP wastes the clean IP.

Nothing here is exotic, and that is the point - anonymous checkout plus a default password on port 22 is a server that stops being yours within days. Ten minutes of sequence buys the same posture a named operator would have, minus the paper trail.

How to verify signup is really token-only before you commit a year

Claims about no-KYC are cheap; the checkout either asks or it does not. Verify ours - or any provider's - with a dry run that costs nothing: start signup and stop when you reach payment. The evidence is in what fields appear and which are mandatory.

On this checkout the account is created from a generated token; there is no name field, no address, and the email field can be left empty. Nothing in the flow requests a phone number or document. If you continue to invoice, the payment step lists 19 crypto assets - BTC, XMR, ETH, BNB, SOL, LTC, TRX, XRP, DOGE, DASH, ADA, GRAM (TON), and USDT on TRC-20, ERC-20, BEP-20, Polygon, Arbitrum, Optimism and SPL - and no card form exists anywhere in the product, which is a stronger property than "cards optional".

Verify the operation side the same way, before money moves: ask support which datacenter code your deployment carries (IS-RKV, CH-ZRH and so on) and what the host records about an order. The honest answer is payment records and abuse handling - a provider claiming it stores nothing at all is describing a service that cannot fix your ticket. What the design does mean: the link between the server and you is the token and the payment's origin, so both of those are yours to keep clean, and the dry-run test proves the first half costs nothing.

Run the dry run on a monthly term after you are satisfied; there is no reason to discover a mandatory field you dislike after pre-paying a year at -20%.

Payment sent, server not up: symptom, cause, fix

Crypto settlement is the one part of the flow with real-world delay, so distinguish settlement from malfunction before ticketing.

The meta-rule: the txid is your entire evidence set, so copy it at send time. Refunds, where applicable, can only reference the chain, not a card processor - which is also why the sending wallet matters more than with cards.

Renewals and account recovery without a mailbox

The recurring cost of anonymity is not surveillance, it is losing the keys to your own account. With a token-only signup and an optional email, there is no "forgot password" link waiting in an inbox, so recovery discipline has to come from you.

Store the signup token the way you would store a seed phrase: offline, in more than one place, never in the same password manager as the servers' SSH keys (one breach should not cost both layers). Record the renewal dates explicitly - month, quarter or year - because the only renewal notice you get is whatever channel you attached, and none at all if the email field stayed empty. A lapsed anonymous VPS does not nag; it just releases your data when the term ends.

Renewal payment has its own hygiene point. Paying each invoice from a fresh exchange withdrawal is the pattern that slowly de-anonymizes a setup, because every withdrawal is a timestamped on-chain event. Two alternatives that avoid it: withdraw a buffer to your own wallet and pay several invoices from there, or pre-fund the account balance - the tiers add +10% at $1,000 and +40% at $2,000 - so renewals draw down a balance that was funded once. The balance approach also shrinks the number of on-chain events tying any single invoice to a moment in time.

Finally, plan the end, not just the continuation. Before any term lapses, export what matters - configs, keys, data - to storage you control (the storage line from $24/mo keeps 1-5 TB NVMe in the same no-KYC billing world). The design assumes you are a competent operator; everything above is what competent means here.

A minimal threat-model worksheet to fill in before you deploy

The short answer: a no-KYC checkout removes the host from your exposure list, but it does nothing about the other parties who could link the box to you - so spend ten minutes writing down who those parties are before you pay. The buyers who get burned are rarely traced through the invoice; they are traced through a domain record, a DNS zone on their home resolver, or a client device that talks to the box with identifying metadata.

Fill in four lines. Line one: who am I keeping distance from - an ISP, a former partner, a platform's abuse automation, or a state actor. Line two: what links exist outside the payment - the domain's registrant record, TLS certificate transparency logs, the nameservers the domain uses, and any email address in a whois or an app config. Line three: what does my client leak - a browser fingerprint, an account login made from a home IP, a git commit with a real name. Line four: what happens on loss - if the account token disappears, is the box rebuildable from scripts, or is there state that exists nowhere else?

Then map each line to a control you actually control. Registrant privacy or a registrar that does not demand more than it needs; DNS hosted away from the box's own IP; commits scrubbed or signed with a pseudonymous key; backups of the recovery script stored offline. Note what the checkout can and cannot carry for you: signup here works with a token only, email is optional, and payment takes any of the 19 assets from BTC and XMR to USDT on seven networks - so the host never becomes the weak link you fix in line two. The host-side layer is already closed; your worksheet exists to keep you honest about the layers it cannot reach.

The price sheet, October 2026 catalog check

Verified against the current catalog, not a cached snapshot. Nano $5.49 (1 vCPU / 2 GB ECC / 40 GB NVMe; flat $36/yr = $3/mo effective), Starter $8.50 (2 vCPU / 4 GB DDR4 ECC / 60 GB NVMe), Plus $13.50 (4 vCPU / 8 GB DDR4 ECC / 120 GB NVMe), Business $30 (6 vCPU / 16 GB DDR5 ECC / 240 GB NVMe), Pro $45 (8 vCPU / 24 GB DDR5 ECC / 400 GB NVMe), Max $60 (12 vCPU / 32 GB DDR5 ECC / 640 GB NVMe); storage plans run $30-$70/mo for 1-5 TB NVMe (8 vCPU / 32 GB at the top tier); dedicated boxes from Start $79.50 (Intel Xeon E-2388G, 32 GB DDR4 ECC) to Ultra $449.50 (2 x AMD EPYC 9474F / 3.6-4.1 GHz, 512 GB DDR5 ECC-R), all with IPMI and DDoS scrubbing. Terms move the price, not the hardware: month at list, quarter at -10%, year at -20%. Checkout takes 19 checkout assets — BTC, XMR, ETH, SOL, LTC, TRX, XRP, DOGE, DASH, ADA, GRAM (TON) and USDT on 7 networks — no KYC step, email optional, token-only signup available. How the crypto invoice works. Paying with Bitcoin. One honest limit: list prices are what the catalog shows at publish; the invoice always prices your coin at the live market rate at the moment you generate it.