Payment Growth: An Authenticity Audit of x402 Activity

1 · Introduction: The Right Question Is Not “How Many Are Real Agents”

x402 was launched by Coinbase in May 2025; in September 2025 Coinbase and Cloudflare announced plans to establish the x402 Foundation, which became operational under the Linux Foundation in July 2026 [6, 7]. The protocol's progress is not in question. But as the “100 million agentic payments” narrative took hold, a measurement problem became pressing—and it must first be framed correctly. On-chain data alone cannot answer how many transactions were initiated by autonomous AI agents: a transaction that is neither a self-transfer nor circular may still come from a human operating a wallet manually, an ordinary script, a test program, or a marketing campaign. Chainalysis identifies x402 transactions by their on-chain interaction patterns—which establishes that a wallet interacted with the protocol, not who or what controls the wallet [2]. What on-chain data can answer is a weaker but still important question: how much of the activity is more likely to represent independent economic demand rather than manufactured volume. A fast-growing measurement literature has formed around exactly this question since early 2026 [1, 3, 4], and this report synthesizes its evidence.

2 · The Growth Story: 100 Million Transactions and a Speculative Catalyst

Chainalysis's on-chain data show x402 transactions on Base rising from near zero in mid-2025 to a cumulative total of well over 100 million by Q1 2026 [2]. The main driver of this steep curve was not productive spending but meme-coin farming: in Q4 2025, the “pay-to-mint” experiment PING required users to query a URL, receive a 402 response, and pay 1 USDC to mint tokens—turning x402 into a speculative game. Transactions surged more than 10,000% in a single week, PING alone processed over 150,000 transactions in its first month, and Base's near-zero gas fees let users repeat the loop hundreds of times [2]. The catalyst also distorted retention statistics: the PING cohort pushed weekly wallet recurrence to 87% before going dormant en masse, cratering it to 5% [2]. By Q1 2026, as speculative heat cooled, overall growth moderated visibly.

3 · Decomposing Authenticity: The Methodology Determines the Answer

Independent data providers offer the most direct decomposition. Artemis built a filter for x402 that flags wallets repeatedly transacting with themselves or cycling funds between linked addresses; its December 2025 analysis offers an indicative estimate flagging roughly 48% of transaction counts and 81% of transaction volume as gamed activity, with Base carrying about 89% of the more-than-$335 million total and about 86% of 92 million transactions over the period [5]. This must be read as a classification under one methodology, not the industry's final answer: for the same 30-day window, x402.org reported $24 million in volume, Allium roughly $3 million, and Artemis under $2 million [5]. Different linked-address rules, circular-flow definitions, and gross-versus-net conventions can change the measured size of the “x402 economy” by an order of magnitude.

Interpretation diverges as well—and the divergent readings are not necessarily contradictory. Chainalysis reads the migration toward $1-plus transactions as a quality signal [2], while the Artemis analysis notes that the servers with the most sustained activity show exactly the opposite profile—high-frequency, low-value payments with consistently low rates of gamed usage, matching x402's design intent as a micropayments rail [5]. A single metric cannot characterize the ecosystem. Academic work is systematizing the debate: Ling et al. formalize the problem as a population-scale measurement of x402 adoption and authenticity [1]; Wang et al. approach it from the infrastructure side, black-box auditing 15 major facilitators—collectively serving more than 60,000 sellers and 360,000 buyers—finding security-rule violations in every one and quantifying facilitator centralization across more than 119 million transactions [3]; and Li et al. formalize five practical attacks on the protocol [4].

4 · Three Structural Shifts Worth Tracking in the Full-Population Data

The purpose of an audit is calibration, not debunking. Chainalysis's full-population measurements show three structural shifts worth tracking; whether they persist after comprehensively removing linked-address and incentive-driven activity has not been established by any study to date [2, 5]. First, the transaction-size structure has moved up: transactions of $1 or more grew from 49% of total value transferred in early 2025 to 95% in early 2026, while the $0.10–$1 band contracted from 46% to 4% [2].

Second, tester-to-payer conversion is accelerating: the share of wallets that made a single send-to-self test and converted to real outbound payments within the same month improved roughly fourfold over six months [2]. Third, outside major speculative episodes, weekly wallet recurrence has drifted upward—wallets keep interacting with the protocol; whether this represents recurring service demand, repeated experimentation, or renewed incentive activity requires merchant- and service-level attribution to determine. x402-paying wallets are also behaviorally distinct from the average Base wallet (average age 197 versus 423 days; 26 token types held versus 4; roughly 12 times the capital inflows) [2]—features that mark them as a distinct population, plausibly including purpose-created accounts, though the data cannot establish whether they are controlled by autonomous agents or by humans repeatedly using services.

5 · Implications for Practitioners

First, make the methodology explicit. When citing any x402 figure, require disclosure of: the data window and chains covered; whether self-dealing and linked-address cycling are excluded; whether PING-style incentive activity is excluded; and whether the figure is gross or net. Second, put facilitators on the due-diligence checklist: verification and settlement concentrate in a handful of facilitators whose security practices have been shown to be broadly deficient [3], and the systematization literature on blockchain agent-to-agent payments identifies weak intent binding, misuse under valid authorization, and payment–service decoupling as cross-stage structural challenges [8]. Third, calibrate conclusions with the layered framework: 100 million transactions establish L1—x402 has processed substantial cumulative activity; Artemis-style filters attempt to bound L2; L3 requires payment-to-delivery attribution, where measurement remains limited; and the autonomy dimension (L4) has no population-scale attribution method yet. x402 has processed cumulative on-chain activity at substantial scale—but this neither amounts to systematic validation of production-grade throughput nor implies that genuine independent demand has reached comparable scale; the share attributable to autonomous agents likewise remains unresolved.

Data & methods notes

• Chainalysis identifies x402 transactions via on-chain interaction patterns—this establishes protocol interaction, not AI-agent control; its structural metrics are computed on full-population data and have not been recomputed after third-party wash filtering.

• Details of Artemis's filter (linked-address definition, circular-flow definition, PING treatment, gross/net convention) are not fully public; 48%/81% should be treated as estimates under that methodology. The original analysis was published as a long-form X (Twitter) post, with key figures also relayed by media.

• Data are primarily Base-chain; of the three measurement/security papers cited, [3] is accepted at USENIX Security 2026, while [1] and [4] are arXiv preprints.