In May 2026, a public post carrying Morse-coded instructions caused an AI-linked wallet to send $175,000. Roughly 80% was recovered. The transfer was valid on-chain, yet the software had accepted instructions from a source it should never have trusted.
The incident captures a major obstacle to autonomous finance: how do businesses trust AI agents with serious money?
BeInCrypto Intelligence’s State of AI Agent Payments 2026 tracked 6.4 million x402 payments across Base and Solana in 35 days, worth just $119,947. More than 90% were below one cent.
Five industry leaders spoke to BeInCrypto about what comes next.
Millions of Payments, Little Money
x402 lets software pay for online resources automatically. Yet its transaction count says little about actual commercial demand. Some payments may involve testing or repeated service requests.
“Micropayments could remain the majority of transactions while trading and treasury operations account for a growing share of the value moved,” said Amir Forouzani, co-founder and CEO of Puffer Labs.
Saad Naja, founder and CEO of Hygentra, expects AI trading to expand much faster.
“I expect the next 12 months to be a breakout year for agent trading, although micropayments will still dominate transaction count. In 5 years I expect 80% of trading will be agentic,” he said.
That forecast is far ahead of observable evidence. Across four selected Hyperliquid connections, AI-labelled applications accounted for just 0.55% of trading value. Unlabelled AI activity could not be measured.
The Most Dangerous Payment Can Be Legitimate
The report identified two incidents involving $281,200 transferred to attacker-controlled wallets before recoveries. Neither required breaking a blockchain signature. The agents acted on instructions they should have rejected.
“A securely stored private key can still authorize a disastrous transaction if the agent has been manipulated by a malicious website, invoice or response from another service… Spending limits alone are insufficient. You also need to control whose instructions the agent accepts and enforce its permissions independently of the model,” Forouzani warned.
One agent’s mistake could also spread across many others using the same information.
“When thousands of agents buy the same inexpensive feed and act on it at machine speed, one bad input gets repeated across all of them at once, and a spending cap set per agent does very little to contain that,” said Markus Levin, co-founder of XYO.
A Transaction Can Be Reversed After an Agent Acts
Benedikt Bünz, co-founder and chief scientist at Espresso Systems, says agents face another risk when they spend funds before an underlying transaction is final.
“Ethereum transactions are only final after 16 minutes, i.e., they could be reverted before that. Agents either need to sit idle for that time or make their next move on a payment that could still be reversed. This exposure can have dangerous trickle-down effects at scale,” he said.
Automated trades and payments often depend on previous transactions. A reversal can affect later steps. Ethereum’s finality process shows why confirmation and finality matter.
Who Takes Responsibility When AI Gets It Wrong?
In the report’s readiness framework, micropayments scored 60.7 out of 100, while institutional automation scored 12.0. Limited disclosure of real-world results contributed to the low institutional score.
Across 19 products reviewed, the 14 that handled money stayed within human-set limits.
Chandler Fang, co-founder of t54 Labs, sees an unresolved question:
“Now agents have the technical capability to move money around and sometimes make their own decisions. How do we make sure that when agents make the wrong transactions, there are clear procedures and protocols to handle the downside risk?”
Levin expects the next major opportunity to come from physical-world payments.
“The next category of agentic payments I’d expect to grow is payments released once work is done in the physical world, such as a delivery being completed or a job finished on site, and those carry much larger amounts than an API call,” he said.
Such payments require proof that a job was completed, permission rules enforced outside the AI model, and clear liability when a transaction goes wrong. Institutions still need evidence that those safeguards work at scale.
