An AI assistant wakes at 3 a.m., reads a flight-price signal, books your ticket, pays the API that surfaced the data, and routes a USDC micropayment to a second agent that confirmed your calendar is free — all before you reach for your phone. No human approved any of those transactions. A software process held the signing key and decided when to spend.
That is an AI agent wallet in practice.
What Makes a Wallet "Agentic"
A conventional crypto wallet stores a set of cryptographic keys, not coin balances. It requires a human to approve each outgoing transaction: you tap "confirm" in your wallet app, and the app submits the signed transaction to the network.
An AI agent wallet removes the human from that approval loop. The agent — typically a large-language-model (LLM) process running continuously — constructs, signs, and broadcasts transactions on its own. It receives a goal, reasons about how to achieve it, and uses the wallet as its actuator: the mechanism that turns a decision into on-chain state changes.
The distinction from a traditional trading bot matters. A bot follows fixed rules: "if price crosses X, sell." An agent reasons about goals and selects actions. That additional layer of autonomous judgment is what makes custody design consequential — and much harder than it looks.
Frameworks that give agents their planning layer include Coinbase AgentKit, ElizaOS, and Virtuals. Wallet infrastructure providers — Coinbase Developer Platform (CDP), Privy (acquired by Stripe in June 2025), Turnkey, and Crossmint — supply the signing capability beneath.
Five Ways to Hold a Signing Key
Every on-chain action requires a valid cryptographic signature. For a human, that means tapping "confirm." For a software agent, the key must be accessible at runtime. How that key is stored defines almost everything about the system's security profile.
1. Agent-held hot key
The raw private key lives in the agent's process memory or environment variables. Maximum autonomy, zero friction — and maximum blast radius if the agent is compromised, manipulated, or simply makes a bad call. Appropriate only for low-value experimentation.
2. MPC / TSS server wallets
MPC wallets split the private key across multiple servers using Multi-Party Computation (MPC) and Threshold Signature Schemes (TSS), so the full key is never assembled in one place. Signing requires a threshold of cooperating shares — for example, 2 of 3. Coinbase CDP Server Wallets v2, which reached general availability on July 24, 2025, and Turnkey both use this model. A single compromised server cannot drain funds; the agent can sign autonomously, but no single party controls everything.
3. ERC-4337 smart-account session keys
ERC-4337, Ethereum's account abstraction standard, allows a smart account to issue a session key: a scoped, time-limited signing credential valid only for specific contracts, spending amounts, and a defined time window. Enforcement is by on-chain contract logic — the blockchain itself rejects transactions that exceed the policy. This is the strongest on-chain guardrail available today. Safe, which secures roughly $100 billion in assets, ran an "Agentathon" in February 2025 with over $200,000 in bounties to encourage AI-native integrations built on exactly this model.
4. EIP-7702 delegation
EIP-7702 went live on Ethereum mainnet on May 7, 2025 as part of the Pectra hard fork. It lets an externally owned account (EOA) — a normal Ethereum address controlled by a single private key — temporarily delegate its execution logic to a smart contract. The EOA retains its address, but gains session keys, batch calls, and spending caps without migrating to a new contract wallet. For holders with existing assets at an EOA address, EIP-7702 is the pragmatic path to granting an agent scoped, revocable authority.
5. TEE-isolated keys
A Trusted Execution Environment (TEE) is a hardware-isolated compute region — examples include AWS Nitro, Intel TDX, and Apple Secure Enclave — where key material is generated and stored. Even the host operating system and the cloud provider's infrastructure team cannot read memory inside the enclave. The agent requests signatures through an authenticated API; the enclave returns only the signature. Privy's server wallets and Crossmint's agent signer both use TEE isolation. Remote attestation lets an external party cryptographically verify that a specific binary is running unmodified inside a genuine TEE — a public proof about how the agent's keys are managed.
The autonomy-versus-control spectrum runs from hot key (most autonomous, least safe) through MPC and TEE-isolated server wallets and EIP-7702 session delegation to ERC-4337 smart accounts with on-chain policy (most controllable, fully auditable on-chain).
The Wallet Infrastructure That Ships Today
Several products established themselves in the agentic wallet market through 2025 and into 2026.
Coinbase launched "Agentic Wallets" on February 11, 2026 — MPC-secured wallets with programmable session caps, per-transaction spending limits, gasless settlement on Base, and native support for the x402 payment protocol.
Privy, now part of Stripe after a June 2025 acquisition, offers two agent wallet models: developer-owned server wallets the agent controls via authorization keys, and user-owned wallets with a scoped agent signer. Both use TEE-backed key storage with per-transaction caps, allowlisted protocols, and time windows. Privy is also integrated as a wallet provider option inside Coinbase AgentKit.
Turnkey raised $12.5 million in a strategic round in May 2026 — bringing total funding past $65 million, with Sequoia Capital and Circle Ventures among investors. Its approach enforces policy at the signing-service layer: the service refuses to produce a signature if the request violates policy. No smart-account deployment is required.
Crossmint deploys smart contract wallets across EVM chains, Solana, and Stellar. It pairs a developer "owner signer" with a TEE-sealed "agent signer"; spending limits and recipient allowlists are enforced by the smart contract itself — a stronger guarantee than an off-chain check, because the enforcement is on-chain and immutable.
Halliday, which raised a $20 million Series A led by a16z crypto, offers the Workflow Protocol: developers define agent-executed on-chain workflows — cross-chain transfers, treasury management — without writing custom smart contracts.
How Agents Pay Each Other
Holding a wallet is only half of the picture. Payment protocols define how agents transact with services and with each other.
x402 (launched May 2025 by Coinbase) is an HTTP-native payment standard built on the dormant HTTP 402 "Payment Required" status code. An API server returns a 402 response with a stablecoin payment request — price, wallet address, and network. The agent's wallet pays; access is granted; no account setup or billing infrastructure is required. By March 2026, x402 had processed over 119 million transactions on Base and 35 million on Solana at roughly $600 million in annualized volume, with zero protocol fees. The x402 Foundation is co-governed by Coinbase and Cloudflare, with members including Google, Visa, AWS, Circle, Anthropic, and Vercel.
Google's Agent Payments Protocol (AP2), announced September 16, 2025 with 60+ launch partners including Mastercard, PayPal, American Express, Coinbase, and Salesforce, extends the Agent2Agent (A2A) messaging protocol to include payment. Three signed Mandates — Intent, Cart, and Payment — are carried as W3C Verifiable Credentials. AP2 is settlement-agnostic: a payment can clear over a card network, a bank transfer, or a stablecoin rail, with x402 as the designated stablecoin layer.
Mastercard Agent Pay for Machines, launched June 10, 2026 with 35+ named partners, brings card-network rails to machine-to-machine commerce via a scoped agent credential that caps spending, time, and merchant category.
Why Crypto Rails Fit Machine-to-Machine Payments
Card rails were designed for human-scale, human-paced commerce. Interchange fees run 1.5 to 3.5 percent plus $0.50 to $0.80 per transaction — economically inviable for a $0.003 agent-to-agent API call. Authorization on a Sunday may not clear until Tuesday; agents run continuously.
Stablecoin rails on layer 2 networks — Base, Arbitrum, Solana — settle in seconds at sub-cent fees, around the clock, without banking hours or clearing houses. Programmable accounts encode spending policy directly in the contract: no more than $10 per hour, only on allowlisted addresses, only in USDC. Stablecoins such as USDC and USDT provide the price stability required for metered billing; the agent budgets in dollar terms without volatility exposure. And composability means value arriving in a smart account can be forwarded to another agent, staked, swapped, or used as collateral — all within the same transaction.
Fireblocks' Agentic Finance report projects stablecoin supply growing roughly 56 percent in 2026 to approximately $420 billion, citing agentic payments as a primary growth driver.
The custody failures, prompt injection attacks, and policy loopholes that accompany autonomous wallets are the subject of Part 5 of this series. Later parts cover Bittensor's model marketplace, ElizaOS and Virtuals, and the decentralized compute layer that runs the agents themselves.
Key Takeaways
- An AI agent wallet is software that holds a signing credential and broadcasts transactions without per-action human approval; the wallet is the actuator that turns the agent's decisions into on-chain state changes.
- Five custody models exist, ranging from raw hot keys (maximum risk, zero guardrails) to ERC-4337 smart accounts with on-chain policy enforcement (maximum auditability, full on-chain verifiability).
- EIP-7702, live on Ethereum since May 7, 2025, and ERC-4337 session keys offer complementary paths for granting an agent scoped, revocable authority without migrating an existing wallet address.
- x402, AP2, and Mastercard Agent Pay are competing payment standards for machine-to-machine transactions; stablecoin rails on layer 2 underpin economics that card interchange cannot match at micro-transaction scale.
- Choosing a custody model before deploying a wallet-enabled agent is not optional — it defines the blast radius when something goes wrong.
Sources
- Coinbase AgentKit documentation
- Coinbase Agentic Wallets launch
- Coinbase AgentKit Q1 update — CDP Server Wallets v2 GA
- Alchemy — EIP-7702 and the Pectra hard fork
- Turnkey AI agent signing infrastructure
- CoinDesk — Turnkey $12.5M raise
- The Block — x402 explained
- Coinbase — Google AP2 and x402 integration
