A new package has landed on PyPI: send21-haystack 0.1.0, a component for the Haystack framework that calls the send21 service to prepare a non-custodial payment request (a pay link). The authors are upfront about one thing: this is not an official deepset integration. On the surface it looks like routine developer news, but it touches a subject every wallet holder should understand — how payment links are built and why they deserve caution.

What a non-custodial payment link actually is

Non-custodial means the service never holds your funds or your keys. It only assembles the transfer details, while you sign and send from your own wallet. A payment link is essentially a pre-filled transfer: recipient address, amount, network, sometimes a token. You open it in your wallet and confirm.

The convenience is real — no more copying a long address by hand and risking a typo. But that is exactly where the risk zone begins: the link leads wherever the person who created it intended.

Where the scams live

Fraudsters have long used payment links and QR codes as a tool for substitution. The usual patterns:

  • Swapped address. A link that looks identical leads to someone else's wallet. You confirm, the money goes elsewhere.
  • Swapped network. You see an amount in USDT, but a different network is selected, with a different recipient or fee. The result is lost or stuck funds.
  • Service phishing. A clone page asks you to "connect your wallet" and sign a transaction that actually grants access to your balance.
  • Subscription scams. A payment link is dressed up as a subscription sign-up, while the charge turns out to be a one-off transfer into the void.

How to protect yourself: concrete steps

The rules are simple, but following them closes most theft scenarios.

  • Always verify the address and network in your wallet's confirmation window — not on the page that sent you the link. The first and last characters of the address should match what you expect.
  • Never sign blindly. If your wallet shows an "approve" or "connect" request instead of a transfer, stop and figure out exactly what you are permitting.
  • Check the source of the link. A payment link from a stranger in a messenger is almost always a risk. Legitimate services generate links inside their own interface, not in a private chat.
  • Turn on 2FA for exchanges, email and every service where you store credentials. Prefer an authenticator app or a hardware key over SMS.
  • Keep a separate working balance. A small amount in a hot wallet for everyday payments, the bulk of your funds in cold storage.
  • Vet packages and plugins. The send21-haystack story is a reminder: third-party libraries and integrations are code you run. Install only from trusted sources and check what the package actually does.

The practical takeaway

Payment links make transfers more convenient, and the non-custodial approach is inherently safer than trusting someone else with your keys. But convenience does not cancel the core rule: the final say is always yours, in the wallet confirmation window. Verify the address, the network and the nature of the signature. If something feels off, cancel and double-check — it beats sorting out a loss later.

This material is informational and not financial advice. Manage your crypto assets mindfully and never send funds via links from unverified sources.

Service and framework names belong to their respective owners and are mentioned only to describe a payment scenario; VirtCardPay is not affiliated with them.

Payment guides

VirtCardPay

A virtual card in 2 minutes

Pay for subscriptions, AI tools, travel, and international stores. Top up with USDT or TON.

Open in Telegram Learn more about the service →

Sources

This material is for informational purposes only and is not financial advice. Data and service terms may change, so check primary sources before making a payment or investment decision. Mentions of third-party brands and services do not imply official partnership, support, or endorsement by VirtCardPay.
Back