AI agents completed 138 million encrypted payments. What did they buy with them?

In its 2026 North American study, Chainalysis stated that there were over 138 million x402 payments recorded on the Base chain. This number is quite large, but individual payments are usually small. Some software purchases involve data, code audits, and access to AI models. Earlier activities also included a speculative token minting, which generated transaction volume but did not prove the existence of a sustainable service economy. More indicative are those wallets that repeatedly replenish funds and make payments to providers of specific types of services.

• According to Chainalysis, as of the end of its 2026 reporting period, there have been over 138 million x402 transactions on the Base chain.
• In their extended sample set, over 87% of the payment amounts fell within the range of $0.0001 to $0.10.
• The proportion of wallet groups that replenish funds again within 30 days after meeting the conditions has increased from 70.6% to 89.3%.
• The median time from the first acquisition of funds to the first payment has decreased from 73 days to 18 minutes.
• Wallets related to the United States account for 88.1% of payments that utilize AI model-based geolocation reasoning.

The Chainalysis research released on October 14th indicates that the categories that can provide an economic context for these 138 million transactions include: AI model inference, code analysis, search and data flow, payment infrastructure, proxy tools, gaming, and token issuance. The report also states that the earliest x402 activities included brief spikes in meme token popularity. On-chain payments may be real, but the services purchased through them could also be speculative creations rather than sustained commercial expenditures.

crypto.news Previous reports regarding the 1 billion transaction threshold have already explained this payment protocol. The new report provides evidence regarding what the recipients sell and whether the wallets will continue to replenish funds for these purchases. These two considerations are more meaningful than simply treating a single transaction as an independent customer.

What exactly is included in 138 million transactions?

Chainalysis describes x402 as a protocol released by Coinbase in 2025, which allows software to pay for web resources when the server requests a payment. A wallet can transfer stablecoins, receive the resources, and then continue with its tasks without the need for manual authorization for each transaction. The activities observed in the report are those on the Base chain involving x402; they do not represent the total payments across all chains, nor do they encompass all commercial activities conducted by the AI system through bank cards and regular bank accounts.

The total of 138 million transactions as of the end of the 2026 research period; the report defines this period as the 12 months up to July 1, 2026. Chainalysis extends the study of payment amounts to September as well. These are two different time frames for observation. If we mechanically apply the 87% proportion of small transactions from the extended sample to all 138 million transactions, it would create an illusion of precision unless the underlying dataset and definitions are exactly the same.

The report states that in the extended window, over 87% of the payment amounts ranged between $0.0001 and $0.10, representing a span of 1,000 times. Multiplying the number of transactions by an assumed average value does not yield a defendable total dollar value. The large number of small transfers indicates that x402 is suitable for API calls; however, this does not reveal the income of the proxy service provider, nor does it show the transaction fee income of Base.

Transactions are actions, not people. A developer can fund multiple wallets; a wallet can also call the same API hundreds of times repeatedly. A certain service may also generate a large number of low-value transactions during promotional activities. Therefore, the number of transactions is the best indicator of protocol usage. The measure of independent paying customers is the weakest. Only if duplicate and unrelated transaction counterparts, as well as continuous revenue, can be identified, will the latter claim hold more weight.

Purchases are concentrated in information-based services.

According to Chainalysis, it has tracked millions of transactions that flow from proxy wallets to code review, financial intelligence, data, and search providers of API. Model inference – that is, generating responses using paid AI models – is also an important category. All these scenarios are in line with the purchase situations of software that has been assigned tasks and requires external answers or up-to-date information to complete its work.

An agent that checks smart contracts may pay for analysis services for security audits; financial instruments may purchase market data queries; travel or research assistants may buy access to databases that they would otherwise not be able to read. These examples illustrate the categories described in the report, rather than a thorough verification of each wallet's identity. The classification of Chainalysis relies on identifying the receiving service and tagging the wallets; activities beyond this observation range may vary.

The report also tracked payments flowing to proxy frameworks, tool directories, payment channels, games, token issuers, and gambling-related services. Collecting these transactions under the term AI productivity expenditures obscures the differences between them. A robot purchasing the reasoning services of another model may be part of a continuous software workflow; whereas a wallet making a payment to mint meme coins could be a speculative gamble. Both use the same payment protocol and may also appear similar at the transaction level.

Previous reports regarding the integration of proxy payments (crypto.news) showcased enterprise scenarios for programmatic spending (USDC) and related control measures. It demonstrated that developers can design realistic payment processes, but this does not allow them to determine which of the 138 million transactions originated from the Amazon service. A dataset wallet from a single source cannot be attributed to a particular company without a direct connection.

A meme coin demonstrates how the volume of transactions can be exaggerated.

Chainalysis's research on the x402 event released in June stated that the "paid minting" experiment of PING drove a surge in early adoption. Users called a certain endpoint, received payment requests, and then paid to mint tokens. The protocol handled these calls as designed. However, the demand during PING does not prove that developers will continue to pay for useful data or insights even after the speculative frenzy subsides.

A report in October stated that the transaction structure is gradually maturing towards information services. There is an observable counter-evidence to this claim: after a one-time promotional campaign ends, do the payment addresses related to code review, data, and model services continue to receive payments? Do the same customers continue to replenish their budgets and use these services over multiple reporting periods? Without transaction volume and amount data broken down by category, narrative changes may precede actual changes in the transaction structure.

crypto.news Another analysis regarding the proxy payments of XRPL converts a large number of transactions into network fees of approximately $280 at the prevailing rates at that time. The rate structure of Base is different; therefore, one cannot simply multiply the fees of XRPL by the figure of 138 million from Base. This comparison illustrates that transaction volume, amount transferred out, service revenue, and network fees must be considered separately and not mixed together.

x402 transactions may involve only a fraction of a cent, which makes the economic model of bank cards difficult to apply. However, low settlement costs are just a part of the total costs. There is also the need for manual funding of wallets, management of keys and permissions, handling of sanctions and fraud risks, verification of receipts, and solving issues with failed API responses. Cheaper marginal transfers are only truly meaningful when fixed costs and operating costs can be diluted by a sufficient amount of effective work.

Recharging the wallet is a better signal of customer retention.

Chainalysis is grouped by the quarter in which the wallet first receives funds. Among the eligible wallets, the proportion of those that received a second deposit within 30 days increased from 70.6% in the third quarter of 2025 to 89.3% in the second quarter of 2026. Researchers required that wallets make transactions on at least two different dates, therefore experiments conducted on a single day were excluded from this calculation. Re-funding indicates that operators provide capital for ongoing activities, but it does not prove that this is a profitable business, nor does it prove the existence of independent users.

The denominator is very crucial. The 89.3% mentioned here does not refer to 89.3% of all wallets that have come into contact with x402. It represents a group that has met the activity requirements and has a complete 30-day observation period after screening. According to Chainalysis, the second quarter of 2026 is the last group to have this complete observation period. If this proportion is applied to all proxy wallets, it would overstate the retention rate. Even for wallets that meet the criteria, the second round of funding may be small, or it may just be part of a test.

The median time from the first receipt of funds to the first payment decreased from 73 days at the end of 2025 to 18 minutes in the third quarter of 2026. According to the same study, the proportion of expenditures starting within one hour after funds were received increased from 4% in the third quarter of 2025 to 67% in the third quarter of 2026. This pattern suggests that the wallet is more suited for immediate tasks rather than being left idle for a long time, waiting for someone to use it. The report does not show the complete software tasks performed by customers; therefore, the interpretation of intentions is still based on temporal characteristics.

If these quarters are extended by a few more months, it will be possible to test whether this improvement is sustainable. If newly funded wallets continue to replenish their funds, but most of the services they purchase are related to their own operators, that indicates operational reuse rather than a broad market effect; if independent suppliers receive repeated payments from multiple separately funded agents, then the claim that the machine-to-machine market is truly functioning will be more substantiated.

The dominant position of the United States depends on the category and sample.

The report states that in transactions involving proxy services that can be geolocated to US-funded wallets, US-related wallets account for 30%. However, in the sub-field of AI model inference, this proportion reaches 88.1%. Different denominators explain why these two figures can both be true. US wallets dominate access to the payment model in sub-samples with geographic tags, but this does not mean that 88.1% of each x402 payment on Base comes from US wallets.

Wallets related to China account for about nine-tenths of the transactions in the categories of security and code analysis with labels, and most of these transactions flow to AgentLISA and Chainalysis. The prominent position of a single recipient may affect the national proportion, but this does not mean that 90% of the expenditures made by Chinese agents are used for security purposes, nor does it imply that each of these wallets belongs to Chinese residents. The geographical attribution of on-chain addresses is merely an estimate based on available signals.

Researchers believe that different models of economics may explain why wallets in the United States are more likely to pay for reasoning, while operators in China tend to use open-source weight alternatives. This is an explanation proposed, rather than a fact that can be directly identified in the field of transactions regarding model prices or customer motivations. An operator might also pay for services in the United States from other locations, or transfer funds through exchanges, which complicates the geographical labeling even further.

crypto.news Report on USDC in proxy payments describes the important role of settlement denominated in US dollars. The proportion under a specific dataset and date should not be directly applied to each transaction in new Chainalysis samples. The truly valuable connection is structural: low-value automated purchases require a unit that sellers can price, which does not change value due to fluctuating tokens between request and fulfillment.

Behind the autonomy lies the budget owner.

Agents can decide when and where to purchase API results, but it is still humans or organizations that fund their wallets, define permissions, and replenish funds. A payment software process that does not require manual clicking with each request is not an entity with independent financial responsibility. Enterprises that deploy agents need to set restrictions based on supplier, amount, time, and type of service, and must have a way to revoke compromised credentials.

The payment itself can be seen on the blockchain, but the results of the purchase are often off-chain. Blockchain records show that tokens have been transferred to a provider, but it is usually not possible to prove whether the returned data is accurate or whether the model’s answers are useful. Services may charge for accessing an unavailable endpoint, or malicious agents may purchase irrelevant information. Receipts and dispute resolutions must correlate token transfers with API responses.

The report on the x402 data gateway by The Graph explains why pay-as-you-go API access is attractive to providers. Charging per query can attract customers who are unwilling to purchase a subscription; however, it also exposes sellers to a surge in requests and buyers to an uncontrolled cycle of repeated calls to the same endpoint. Spending limits, logging, and anomaly alerts can help mitigate these risks. A settlement transfer protocol alone cannot determine whether a proxy truly needs that answer.

Attribution also presents another challenge. A wallet may be labeled as a proxy simply because it uses x402, but the payer could also be a human script, a trading bot, or a promotional service. The classification of Chainalysis measures observable interactions, rather than the private models and decision-making processes behind each transaction. A more honest description of these 138 million transactions is that they are Base chain x402 payments related to commonly used protocols with proxies, accompanied by the categories and restrictions disclosed by researchers.

Stronger evidence and missing revenue figures

Coinbase and Circle have a compelling argument: the bank card network is not suitable for machine-scale charging. A data request of just 1 cent cannot bear the same fixed economic costs as a regular card transaction. Chainalysis The evidence that many eligible wallets can quickly replenish funds and make expenditures supports a new use case that goes beyond a "one-day demonstration." Enterprise integration provides another path for these channels to access real software budgets.

However, these pieces of evidence are still not sufficient to constitute a complete income ledger. The report provides a large cumulative number of transactions, a broad distribution of small payments, and some wallet behaviors. It does not provide the total audited income derived from the paid model reasoning, the net earnings of the API sellers, nor does it indicate the number of unrelated companies that have funded these wallets. Even if the total amount is substantial, it may include duplicate transfers between related accounts; even if the total amount is small, it could have funded useful and inexpensive work. What is missing is the demand side at the recipient's end.

The next more valuable report should provide the volume of transactions and their value in US dollars for each category over a comparable period, the number of independent paying organizations when attribution is possible, duplicate payees, refund situations, as well as the proportion of transactions related to speculation. It should maintain visibility of unknown activities, rather than attributing a commercial purpose to every transaction. The group data with Chainalysis is sufficient to indicate that this market is worth close study, but it is not yet enough to draw a definitive conclusion about its economic scale.

The denominator of 138 million requires transaction auditing.

On-chain payments are observable, but determining whether a wallet belongs to the AI agent is a classification task. The x402 marker denotes a specific type of exchange between the client and the service. Humans can write scripts to initiate these calls, and models can also make such calls after being authorized by developers with a budget. The statistics of Chainalysis are valuable because they track a well-defined protocol; however, they should not be interpreted as decisions made by 138 million individual machines. The number of independent payers, suppliers, and completed tasks is not included in this figure.

A useful audit should involve sampling and examining payment contracts or accounts within each category to verify the services provided, and to estimate how many transactions have flowed to the infrastructure of the same operator. Developers can legally transfer payments between components under their control to test applications; such activity indicates that the channels are usable, but it does not represent external income. Public ledgers can reveal duplicate addresses and amounts, but to prove who controls each wallet, off-chain evidence is often still required.

The cumulative number of transactions also includes periods with significant behavioral differences. The report for Chainalysis6 month describes a surge in speculation in the early stages; the report for October, on the other hand, indicates an increase in the use of information services. Comparing the total historical volume with the current month's service structure may make new uses appear more significant than they actually are. If there were data by month with the same labeling rules for different categories, it would be possible to determine when useful purchases surpassed promotional activities—assuming such a correlation has indeed occurred. In the absence of such a sequence, any directional judgments can only be considered qualitative classifications by researchers, rather than published cross-sectional dates.

The flow of stablecoins can also be amplified due to the repeated use of the same funds. A wallet with only $10 in funds may initiate hundreds of small transactions before replenishing its balance. Adding up the total amounts of these transfers can show how frequently payment requests are made, but this does not mean that each time there is a new inflow of $10 in capital. The net income of sellers, after refunds, transaction fees, and retransfer to associated wallets, is what constitutes the actual revenue. The amount of on-chain payments and revenue should not be considered synonymous.

Why the first expenditure time is more important than the number of registrations

Reduced from 73 days to 18 minutes, this indicates that the time required to create a wallet or make a capital contribution is now closer to the point in time when a paid service is needed. This represents an operational change. It could be due to developers improving the integration, or it might be that financial tools are automatically configuring wallets, or perhaps the participant base has shifted towards operators with immediate needs. The data presented in the report demonstrates this outcome and supports the interpretation of "purposeful use"; however, it does not distinguish which specific factor led to this change.

In the new group, the proportion of expenditures starting within 1 hour reached 67%, which is particularly informative when considered together with the statistics from the second round of funding. A wallet that makes a quick one-time payment may still just be an experiment; whereas a wallet that makes multiple payments over several days and receives funds again within a month is more likely to be engaged in continuous operations. Looking at these two figures separately does not allow for the identification of the end-users; however, when combined, they provide a more accurate reflection of the actual operational situation than a chart showing the total number of wallets created.

Further testing can involve tracking each group for 90 days, recording the number of active days, supplier diversity, and stable coin expenditures. The second funding round a month later may simply be a fixed transfer set by the developers. Supplier diversity can indicate whether purchases are made across the entire ecosystem or within a single application. The same definitions should be maintained among different groups; if the rule is changed from two active days to one, the retention rate may seem higher, but the behavior itself does not change.

There is a useful distinction when it comes to subscription models. When humans renew a subscription, it often indicates that they believe the service is worth the cost; however, with proxy wallets, funds may be automatically replenished within a budgetary framework, and a true assessment can only be made at an organizational level. Replenishing funds again within 30 days merely proves that money has returned to the wallet, but it does not necessarily indicate that the buyer has achieved a positive return on investment. Customer renewal of a particular service is a stronger indicator of business success.

When the buyer is code, who will inspect the purchase?

Organizations can set daily budgets for agents and approve suppliers, but the software may still make a series of poor purchases within these limits. Payment policies must clearly define who can modify the limits, how vouchers are stored, which type of API response counts as fulfillment, and when to freeze an account. Blockchain can only confirm that tokens have been transferred; it cannot verify whether the information is up-to-date or whether the purchased computations have been successfully completed.

Small payments can become a major cost due to their frequency. If an agent sends a request for 5 cents per second, it will cost $180 in one hour without any interruption; if each request costs 10 cents, the cost per hour would be $360. These figures are based on the hypothetical calculation of "rate multiplied by amount" and are not observations from Chainalysis. They illustrate that even when the unit price is very low, there is still a need for rate limits, expenditure caps, and alerts that are triggered during the agent's operation cycle.

Proxies may also purchase content from malicious services, and what is returned is often instructions rather than the requested data. Software that accepts external responses must separate paid content from permissions to the wallet. The approval lists of payment systems and the boundaries of model instructions represent two different sets of controls. Even if a system can verify invoices, if it trusts every returned message, it can still be exploited even when the payment protocol has not failed.

At the compliance level, the terms 'funding provider' and 'recipient' are more meaningful than the label 'agent'. The geographical identification of Chainalysis relies on the attribution of the source of funds; therefore, unknown locations should not be included in national percentages. Enterprises need to maintain records that link wallets, human budget holders, and supplier accounts. If an agent is purchasing regulated services, automated requests do not exempt the enterprise from its own legal obligations.

When the payment amount is less than the cost of the investigation

Small payments have transformed the economics of supervision. It is impossible for businesses to manually review every 5-cent transaction or API call, while also providing services at a cost of 5 cents each. They can examine the source of funds, approve the categories of recipients, and set automatic thresholds to stop or flag abnormal behavior. Investigations are usually conducted only after such patterns or anomalies arise. Chainalysis also emphasizes that settings and destinations should be screened first, but the specific implementation methods vary depending on the wallet provider and the organization.

A wallet with a limit of only $20 can fulfill many low-cost requests, but the rules must clearly specify how the agent should choose between different providers. If a service raises its price from $0.02 to $0.20, the static limit may still allow for a tenfold increase in each expenditure. The agent should obtain the price cap from the operator and default to failure if the provider exceeds that cap. It's worth reiterating that transfers can be correctly settled, but the purchasing decision may still be incorrect.

A receipt requires a third party that both the buyer and seller can audit. The hash of a stablecoin transaction can prove that a payment has occurred; a service response identifier can indicate which specific query this payment corresponds to. If a customer disputes the charge, or if API times out after receiving the payment, these two factors must be linked together. A service that lacks available retry or refund processes may have a large volume of transactions on the blockchain, but its retention rates (i.e., the percentage of payments that are successfully completed) will be poor.

The same issue also affects fraud measurement. Malicious actors can route a large number of cheap calls through services they control to inflate their apparent user base. The costs may consist only of network fees, development time, and any conversion losses; as funds circulate, these costs can be far lower than the nominal transaction volume mentioned in the headlines. Serious dashboards should report independently controlled buyer traffic and recurring service revenues, rather than just the number of transactions.

The next report could distinguish one industry from a single demonstration.

To prove that this is a legitimate industry, evidence should include: service providers receiving continuous income from unrelated agents, operators increasing their budgets based on evaluation results, and multiple suppliers competing in terms of price and quality. Chainalysis New categories of payees and wallet groups have indeed taken the discussion in this direction, but they have not yet identified the end-users who are actually making the payments, nor have they explained the profits generated from service sales.

The low-value distribution makes this use case stand out. Data requests that cost just a few cents each may not be feasible through traditional bank card channels, but programmable wallets can handle them while the software tasks are running. However, the world of traditional card payments also offers account-based billing and monthly summaries, which can support small transaction amounts as well, without the need to swipe the card with each transaction. The advantages of x402 should be compared with this alternative solution, rather than just with the absurd scenario of “swiping a card for just a fraction of a cent each time.”

Providers can choose to opt for subscription, prepaid credits, or pay-per-use using x402. Customers may also prefer different models. If proxy payment can reduce integration barriers, access a useful market of buyers, and be settled at an acceptable total cost, then it will gain a lasting position. The figure of 138 million indicates that the software is already being used through this channel; it will be the category and revenue data over future periods that will show how much economic activity is actually supported by it.

Content worth noting

• Comparable period: The number of x402 transactions and their dollar value on Base, using the same classification window.
• Recipient structure: Flow reasoning, data, code review, and the proportion of payments and amounts in speculative token activities
• Wallet Group: Repeated Capital Injection Ratio under Clear Activity Filtering Conditions and a Complete Observation Period
• Concentration: In each category, do a few services or wallets account for most of the traffic?
• Control Measures: Public Product Terms for Proxy Budgets, Supplier Permissions, and Handling Methods for Failed Payment Requests

Frequently Asked Questions

AI Did the agent really complete 138 million payments?

According to Chainalysis, as of the end of its 2026 reporting period, Base recorded over 138 million x402 transactions on the chain. However, protocol interactions do not prove that each transaction came from a different autonomous agent.

What did these proxies buy?

The categories identified by Chainalysis include model inference, data and search API, code analysis, financial intelligence, tools, gaming, as well as token-related services. It does not publish a complete invoice for each transaction.

How large are these payments?

In the sample extended amounts reported, over 87% of the payments were between $0.0001 and $0.10. Based solely on this distribution, it is not possible to determine the total amount of payments in US dollars.

What is x402?

It is a payment protocol that allows software to respond to payment requests for web services, typically completing payments with stablecoins in exchange for the corresponding resources. Coinbase released it in 2025.

Do 138 million transactions equal 138 million users?

No. A wallet can be used for multiple payments, and an organization can also control multiple wallets. Independent customers require a different way of measurement.

What evidence is there to indicate that it will be reused?

In wallet groups that met the criteria, the proportion of re-investments within 30 days increased from 70.6% to 89.3%. This metric excludes wallets that only conducted transactions within a single day.

Why do American wallets account for 88.1%?

This ratio refers to the geographic location-based x402 payments inferred by the AI model, and not all proxy transactions. It depends on the wallet attribution and service classification of Chainalysis.

Can these data indicate that the proxy economy is already profitable?

Not possible. Transactions and data recharges can only indicate activity and repeated capital injections; seller income and operating costs require separate evidence. This article is for educational analysis purposes only and does not constitute investment advice.