AI Agents Made 6.4 Million x402 Payments Worth Just $119,947

6.4 Million Payments, $119,947 in Value

Autonomous software is transacting at a frequency no human payment system approaches, yet the money involved is almost negligible. A new research study on agentic payments, the State of AI Agent Payments 2026, tracked 6.4 million x402 transactions across Base and Solana over a 35-day window, and the combined value of all that activity came to just $119,947. More than 90% of the payments were worth less than one cent. The x402 standard is a protocol that lets software pay for online resources automatically, machine to machine, with no human approving each individual call; it is the settlement layer underneath what the industry markets as PayFi. High counts, however, say little about genuine commercial demand, since some recorded activity reflects testing or repeated service requests rather than purchases. The same study documents why institutions hesitate before handing agents serious money. In May 2026, a public post carrying instructions encoded in Morse code caused an AI crypto wallet to send $175,000 on its own. Roughly 80% of that amount was later recovered. The transfer itself was valid at the chain level; the failure sat in the software, which had accepted instructions from a source it should never have trusted. That single episode frames the report's central question: how does a business delegate meaningful funds to a program that can be talked into sending them away? The readiness framework graded micropayments at 60.7 out of 100 while institutional automation scored just 12.0, a gap the authors connect to limited disclosure of real-world results. Of the 19 products reviewed, the 14 that actually handled money stayed within limits set by humans. Amir Forouzani, co-founder and chief executive of Puffer Labs, expects micropayments to remain the majority of transactions even as trading and treasury operations take a growing share of the value moved.

Two Incidents, $281,200 Sent to Attacker Wallets

The security findings read as the harder constraint on adoption. Two documented incidents saw $281,200 transferred to attacker-controlled wallets before partial recoveries, and neither required breaking a blockchain signature; in both cases the agents acted on instructions they should have rejected. Forouzani's warning cuts to the mechanism: even a properly secured hot wallet can authorize a catastrophic transaction if the agent is manipulated through a malicious website, a fraudulent invoice or a crafted response from another service. Spending caps alone are insufficient, he argued, because permissions must be enforced independently of the model itself. XYO co-founder Markus Levin described a second failure mode, correlation. When thousands of agents subscribe to the same inexpensive data feed and act at machine speed, one bad input replicates across all of them at once, and a per-agent cap does very little to contain the damage. Espresso Systems co-founder Benedikt Bünz added a timing risk tied to consensus: Ethereum transactions become final only after roughly 16 minutes, so an agent must either sit idle through that window or build its next move on a payment that can still be reversed, an exposure he said can produce serious trickle-down effects when many automated flows depend on earlier steps. Forecasts, meanwhile, run far ahead of observed activity. Saad Naja, founder and chief executive of Hygentra, expects the next 12 months to be a breakout year for agent trading and projects that 80% of trading will be agentic within five years. Measured behavior is smaller by orders of magnitude: across four selected Hyperliquid connections, AI-labelled applications accounted for just 0.55% of trading value. Levin expects the next growth category in payments released against completed physical-world work, such as a finished delivery, which carry much larger amounts than an API call and demand proof of completion plus clear liability. Chandler Fang, co-founder of t54 Labs, framed the unresolved governance question: when agents transact wrongly, what protocols exist to absorb the downside?

Our reading is that this dataset splits agentic finance into two different problems. The 6.4 million payments prove the rails work at micropayment scale; the 12.0 institutional score proves they do not yet work at treasury scale, and the gap is instructional, not cryptographic. Both loss incidents were valid on-chain transfers, meaning signature security did its job while the instruction layer above it failed. Until permission enforcement independent of the model becomes a standard product feature, expect institutions to hold agent exposure inside tight human-set limits, exactly where 14 of the 19 reviewed products already operate.