Around 138 million of them have already happened, and more than 87% were worth ten cents or less. The count is the least interesting part. What matters is that almost none of them touched a card, and not one of them can be reversed.
Chainalysis published its read on machine payments on October 14, and the headline figure has been passed around since. More than 138 million payments moved through Coinbase’s x402 protocol on Base, the great majority of them for amounts between one-hundredth of a cent and ten cents. The firm also found that the average gap between funding an agent’s wallet and that wallet making its first payment collapsed, from 73 days in late 2025 to 18 minutes by the third quarter of this year.
For anyone running a card program, the temptation is to read that as a market forecast. It is better read as a description of a payment type that card rails were never built to carry, running on rails that lack the one feature card programs sell. Both halves of that sentence matter.
What the number actually counts
Chainalysis counted 138 million payments it could identify on one protocol, on one chain, and it excluded wallets that transacted on only a single day. Coinbase, counting its own protocol’s first year, has put the number at more than 169 million across 590,000 buyers and 100,000 sellers. Neither figure is wrong. They are measuring different things, and the distance between them is roughly the size of the methodology.
Both counts also cover a single protocol. x402 has a foundation behind it, set up with Cloudflare in September 2025, and it is one of several competing answers to the same problem, so even the larger figure is a slice of machine payments and not a census of them.
The firm was careful about what a count can support. Transaction volume on its own does not establish how much of this is genuine commercial demand, and earlier research has raised questions about artificial activity on the network. A programmatic payment costs almost nothing to repeat, which means a count is the one metric in payments that is easiest to inflate and hardest to interpret.
So treat the figure as evidence that the plumbing works at volume, not as evidence that 138 million purchases happened.
Why a dime does not fit on a card
The reason these payments are not card payments is arithmetic.
A card transaction carries a cost structure with a floor under it, because part of that cost is fixed per transaction and does not scale down with the amount. Charge a tenth of a cent through it, and the cost of the transaction exceeds the transaction. There is no version of card acceptance where the sale is worth less than the message that authorizes it.
The protocol carrying these payments was designed around that constraint. The x402 standard, introduced by Coinbase in May 2025, revives an HTTP status code that has sat unused for most of the web’s life. A client asks a server for something. The server answers 402, meaning payment required, and states its price and the tokens it accepts. The client signs a payment and retries the same request with that payment attached in a header. A facilitator verifies and settles it on-chain, and the server returns the data.
What is absent is the point. No account to open, no card to provision, no API key, no interchange, and no prior relationship between the two parties. Onchain fees on a layer two have fallen to roughly a cent, which is what makes a payment worth a hundredth of a cent arithmetically possible at all. Amazon has put the protocol inside its agent runtime, where settlement on Base takes around 200 milliseconds.
Read more: Rain’s $250 million round prices stablecoin card plumbing • How merchants receive stablecoin payments, by card rail or direct checkout
What the agents are buying
Not retail. The payments are going to data, computing power, access to AI models, and security and code-analysis services, which is to say agents buying their own inputs from other machines.
The geography is the surprising part. On payments for model inference, wallets linked to the United States account for 88.1% of the traffic that could be located, and wallets linked to China for 0.1%. Flip to security and code-analysis services and the picture inverts: Chinese-linked wallets make up roughly 90% of located payments, much of it going to a single smart contract auditing platform.
Chainalysis offered a reading and stopped short of a conclusion. Its Eric Jardine suggested Chinese developers lean on open-weight models they can run themselves, which removes the need to pay per query, and he warned against treating that as evidence that open-source AI is hollowing out the Asian payments market. It is a good instinct to borrow. Most of what looks like a market signal in this data is a developer preference with a payment attached.
Mastercard built the other half
While the protocol side was proving volume, the network side was building the thing the protocol lacks.
Mastercard launched Agent Pay for Machines on June 10, naming 32 entities alongside it, among them Cloudflare, Coinbase, Stripe, Polygon, Rain, Tempo, Adyen, Checkout.com, Global Payments, RippleX and the Solana Foundation. It settles across cards, accounts, and stablecoins, which is the first thing to notice. The network has placed itself as the layer that routes between rails, a design that only makes sense if it expects agent volume to land on all three.
Two features matter more than the partner list. Every agent is credentialed and recognized across ecosystems through what Mastercard calls Verifiable Intent. And organizations can set authorization rules and spending limits that are enforced programmatically, so an agent’s transactions stay inside parameters a human set in advance.
Cloudflare’s chief strategy officer, Stephanie Cohen, framed the problem the launch is answering. “The internet was built for human interactions, but the infrastructure of the future must be built for autonomous ones,” she said. Note that the sentence says nothing about tokens. The problem it describes is infrastructure built on the assumption that a person sits at one end of it.
What credentialing an agent means in practice
This is where the two architectures stop resembling each other.
On card rails, credentialing means a tokenized credential that stands in for the card and carries proof that a specific consumer authorized a specific agent within set limits. Visa’s version of this replaces card details with exactly that kind of token. Mastercard’s is built on the same tokenization stack already used for contactless and card-on-file payments, extended so a verified agent can transact for a person. In October 2025, Visa went further and launched a protocol with Cloudflare aimed at separating sanctioned agents from scrapers, citing a 4,700% rise in AI-driven traffic to US retail sites.
The consumer-facing version of this already ships. OpenAI’s Instant Checkout, built with Stripe and live since September 2025, settles over card rails using a payment token scoped to one merchant and one cart, so an agent that goes off-script cannot spend the credential anywhere else. Scoping is doing the work there, and scoping is a card-network habit.
On the protocol side, the credential is the signature on the payment. The server does not know who the agent works for, whether a human approved this purchase, or whether the same agent made four hundred identical requests in the preceding minute. It knows the payment is valid. For a tenth of a cent, that is a reasonable trade.
The gap between those two definitions is the entire design question for a card program, and it is a choice about who is accountable, only incidentally a choice about technology. The fight over how agents pay is usually framed as networks against protocols. It is more accurately a disagreement about whether a machine payment needs a person standing behind it.
Nothing here can be undone
Card rails come with chargeback rules, fraud protection, and a dispute process, and those are not incidental features. They are a large part of what a cardholder is paying for and a large part of what an issuer is liable for.
Stablecoin rails settle with finality. There is no reversal, and no native answer to a dispute has emerged. A program that settles an agent’s purchases in tokens has, at the moment of settlement, spent a balance that cannot be clawed back by anybody, including the program.
There is also nobody to complain to. A card dispute has an acquirer at the other end and a rulebook that assigns the loss. An x402 payment has a server that delivered a resource and a facilitator that settled a transfer, and neither is a party to whether the purchase was a good idea.
That is survivable when the payment is a tenth of a cent, and the counterparty is an inference endpoint. It becomes a different product the first time an agent commits four figures to the wrong supplier because a prompt was poisoned or a loop ran twice. The rails will behave identically in both cases, which is the problem.
The size distribution is the safety argument
The shape of the payments is carrying more weight than it appears to. In a thirty-day window in July, the protocol handled around 75 million payments worth about $24 million. That averages out to about 32 cents, against a distribution where more than 87% of payments are a tenth of that or less. A thin tail of larger transactions is doing most of the dollar volume while the enormous middle costs almost nothing.
Irreversibility is cheap in that shape. Lose a dime, and nobody files anything. The question for the next two years is what happens to the tail, because every incentive in the market points toward agents transacting for larger amounts: booking, procuring, renewing, settling invoices. The risk model that works at ten cents does not survive contact with four figures, and nothing about the rails changes when the amounts do.
The other number to hold onto is the 18 minutes. An agent wallet now goes from funded to spending in under twenty minutes, whereas a year ago the same step took over two months. Whatever controls a program plans to apply, they have to be in place before the agent starts, because there is no longer a window afterwards.
What a program should be setting now
Four things to settle before any of this becomes a product question.
Decide who the cardholder of record is. If an agent spends, the liability sits with a person or an entity that authorized it, and that authorization needs to exist in writing and in the system, not by implication. The network credential model assumes this. The protocol model does not supply it.
Set limits that a machine enforces, not ones a human reviews. Per-transaction caps, velocity caps and a daily ceiling are the minimum, and they belong in the authorization path where they cannot be bypassed, which is precisely what the programmatic rule enforcement in the network products is for.
Price the runaway loop in advance. An agent that repeats a payment is not committing fraud and will not trip a fraud model built on human behavior. It will simply keep paying. The only thing that stops it is a ceiling somebody set.
And know which rail each flow lands on. A program working with the enabler layer that prices stablecoin card plumbing will find agent flows settling in more than one place, and the dispute answer differs by rail. The new payment chains being built for dollar settlement are part of the same question, since several of them turned up on Mastercard’s partner list.
Where this lands
Machine payments are not coming. They are a year old, measured in the hundreds of millions, and almost entirely invisible because they are too small to notice.
What has not happened yet is the part a card program would feel. The payments are between machines buying machine inputs, at amounts where irreversibility is a rounding error, and credentialing is optional. Three things will change that: the tail growing, consumer-facing agents transacting on a person’s behalf at human prices, and the first well-publicized incident in which an agent spends money nobody authorized, and nobody can retrieve.
The networks are building for the world after that incident. The protocols are serving the world before it. A program choosing where to sit should be clear about which world its volume is actually in today, and which one it is writing contracts for.