The First x402 Audit: 90% of the Money Was a Bridge, the Median Seller Earned $2.50 — and the Sellers Who Stayed Tell You What Works

What the x402 audit found: five chains, five different businesses, one signature

On September 6, 2026, Bitquery Research published "x402 Protocol: $2.6B a Month Across 5 Chains", the first audit that indexes every x402 payment of 2026 on Base, Polygon, Arbitrum, Ethereum and Optimism and asks the questions a transaction counter can't: which chains carry it, what is being bought, who earns from it, and whether the money goes anywhere near an AI agent. x402 leaves an exact fingerprint on EVM chains — a gasless, signed USDC authorization executed by a facilitator — so the dataset is unusually clean. The conclusion is not: "five chains turn out to be running five different businesses on one signature, and the smallest of them is the one everybody writes about."

The August numbers, chain by chain, are the whole story in one table. Base: 9.7 million payments (53.1%), $35.9 million, median payment $0.006. Polygon: 8.1 million payments (44.5%), median $0.01. Arbitrum: 339,000 payments (1.9%) but $2.33 billion — 90% of all dollars, median $25.61. Ethereum: 57,600 payments, $87.3 million, median $72. Optimism: 28,100 payments, $245,000. Payments live on Base and Polygon. Dollars live on Arbitrum. And the Arbitrum dollars are not commerce.

The bridge that made the headline

Follow the Arbitrum money and it goes almost nowhere. A single verified contract, CctpExtension, took 97.5% of the chain's entire August volume, from 34,577 different payers, at a median of $749 and one single payment of $10 million. CCTP is Circle's Cross-Chain Transfer Protocol — the plumbing that moves USDC from one blockchain to another. What the data shows is people signing gasless x402-style authorizations to push money into a bridge. It uses the same signature the protocol standardized, so it counts as x402, and it is the reason any headline dollar figure for x402 looks enormous. Take that one contract out and the rail moved $317 million in August rather than $2.59 billion.

The loops that made the count

The payment count has the mirror problem. Base and Polygon between them settled 17.8 million of August's 18.3 million payments, and both are dominated by a single repeating relationship. On Base, "one wallet has sent 13.2 million payments to one address over 52 days, and that address has almost never spent a cent." On Polygon, 5.7 million payments were "all for exactly the same amount, one cent," and "moved about $57,000 in total." Whether an AI sits behind any of those wallets is not something a ledger records; what the chain shows is software paying without a person approving it, at a cadence that looks like a load test or a farming loop, not a customer. This is the same composition problem we flagged when daily volume fell 93% earlier this year — the decline was the farming leaving, not the demand — and it is consistent with Chainalysis's June finding that the PING pay-to-mint token drove much of the initial surge before "growth moderated as speculative activity cooled."

The honest core: 2.2 million payments, thousands of sellers, one processor

Here is where the audit becomes useful rather than deflating. Once you remove the bridge and the loops, Bitquery estimates roughly 2.2 million honest payments a month across thousands of buyers and sellers on four chains. That is not a $2.6 billion economy. It is also not nothing: it is more per-request commerce than most API marketplaces have ever processed, and it is growing on the axis that matters, ticket size — Chainalysis notes payments of $1 or more went from 49% of volume in early 2025 to 95% in 2026, while the 10-cent-to-$1 band collapsed from 46% to 4%. The rail is moving from "look, a micropayment" to "buy the data and finish the task."

The audit also answers the question sellers care about most: who is getting paid, and how much of it do they keep. Only one processor in the dataset charges fees — Coinbase's Commerce Payments Protocol on Base, which collected 1.00% on $5,296,811 for 26 merchants, earning $59,295 in August, with a 99.94% completion rate between authorization and capture. Everyone else on the rail is being paid wallet-to-wallet, with no processor in the middle taking a cut. Then the seller distribution: the median Base seller earned $2.50 for the month, and 40% earned less than $1. Of the 80,642 sellers active in July, only 5.8% returned in August.

Read those two numbers together and the picture is a long tail of endpoints that were published, got a handful of curiosity pings, and were abandoned. That would be a grim story if it ended there. It doesn't. Among sellers who received 10 or more payments, retention was 71.1%. The retention curve is bimodal: almost no one keeps buyers they never really had, and almost everyone keeps buyers once there were ten of them. Chainalysis made the same point from the buyer side in June: "retention matters because it is the clearest signal that agentic payments are becoming infrastructure rather than a novelty."

Why the seller distribution looks like this — and what it does not mean

It would be easy to conclude that x402 doesn't work for sellers. The audit says something narrower and more actionable: being agent-payable is nearly free, so most sellers who try it never invested in being worth paying. Listing a paid endpoint in a directory takes minutes. Having something an agent needs mid-task — clean data, a tool that removes a step, compute the agent can't get elsewhere — is the actual product decision, and the median seller skipped it. The $2.50 median is the median of a cost-free experiment, not of a business.

Three structural facts explain the tail. First, discovery is thin. Agents find x402 endpoints through directories like the x402 Bazaar and Agentic.Market, and a census of that ecosystem found 575 listed services, 94% of them on Base. A seller who isn't listed, or whose 402 response doesn't describe what the route does, is invisible to the buyers that exist. Second, buyers are still mostly builders. The wallets funding agents in 2026 belong to developers testing tools, corporate agent programs, and the odd trading bot — not consumers. That means demand concentrates on categories those buyers already pay for: market data, web extraction, inference, verification. Third, the payment is final and tiny, so the seller's entire risk is engineering time. There is no chargeback exposure and no receivable; a seller who earns nothing has lost nothing but the afternoon spent setting up.

What a seller on the right side of the curve looks like: Massive, September 1

Five days before the audit, a seller of the kind the audit is looking for went live. On September 1, 2026, Massive, the US stock market data provider, announced general availability of x402 payments for its equities data, built with Coinbase. Agents pay per request in USDC on dedicated routes at agent.massive.com: bars and aggregates, snapshots, technical indicators, ticker reference data, news with sentiment, and SEC filings. There is no account to create and no API key to manage. The Coinbase Developer Platform facilitator verifies and settles each payment before Massive returns the data. Routes are listed in Agentic.Market and the x402 Bazaar, and each route prices itself in its own 402 response. Nothing about Massive's existing API-key and subscription business changed.

Every element of that launch maps onto a line in the audit. Massive sells something builders already pay for (market data). It is discoverable where agent buyers look. Each route carries its own price, so an agent can buy one snapshot without committing to anything. And the motivation was demand-led, not hype-led — Massive's VP of Product Engineering, Stevie Palmateer: "More and more of our traffic is coming from agents, whether through our LLM-friendly markdown docs or our new MCP server," and on the directory listing: "Being listed in the x402 Bazaar means an agent can find our data and pay for it in the middle of a task." The buyer side keeps thickening on schedule, too: on September 9, Coinbase CEO Brian Armstrong said the company is building "the financial account for AI", with x402 payments for agent-consumed research, data and compute listed as coming soon. More funded agent wallets, looking for exactly the routes Massive just published.

How to be on the right side of the retention curve without building a processor

Massive built its agent routes with Coinbase's engineers. Most API and data businesses can't spend that, and the audit shows most sellers shouldn't spend anything until they know demand exists. This is the gap Payzum's x402 middleware is designed for. Payzum is not the facilitator — settlement runs through an external facilitator, currently Coinbase's, the same one verifying Massive's payments. Payzum is the proxy in front of your existing API: you configure your endpoint, your own API key or bearer token, and a price in the dashboard; Payzum publishes an x402 URL, returns the 402 Payment Required with your price, settles the agent's payment in USDC on Base per call to your own wallet, and forwards the paid request to your real endpoint with your key. No code, no protocol to implement, no custody. Here is the setup, step by step:

1. Pick the routes agents would actually buy. The audit's lesson first: expose the endpoints that remove a step from a task — a lookup, a verification, a data pull, an extraction — and price each one separately, the way Massive prices each route in its 402. Keep your subscription business exactly as it is.
2. Configure the proxy in the Payzum dashboard. Enter the upstream URL, your API key or bearer token (stored encrypted), and a per-call price in USDC. Payzum publishes an x402 URL for that route. Your endpoint never changes and never becomes public.
3. Let the facilitator settle, non-custodially. An agent hits the URL, receives the 402, signs a USDC payment on Base and retries. The external facilitator verifies and settles it — about two seconds — directly to the wallet you control. Payzum never holds the funds; the settlement is the payment.
4. Proxy, log, and get listed. Payzum forwards the paid call to your endpoint with your key, returns the response, and fires a signed webhook for your records. Then do the part the $2.50 sellers skipped: list the route where agents look and describe it well. The first ten payments are the goal; the audit says the rest tends to follow.

Cost matters here because the audit says most experiments earn little at first. Payzum's x402 proxy is designed for that: a monthly free allowance of roughly a thousand calls, then a flat fraction of a cent per call plus gas — no percentage of your revenue and no processor between you and the buyer. That keeps the experiment's cost at what the audit says it should be: an afternoon.

Building it yourself vs. Payzum's x402 proxy — what the audit changes

Objections the audit raises — answered honestly

"If the median seller earns $2.50, why bother?"

Because the median is the median of a free experiment. The audit's other number — 71.1% retention for sellers with ten or more payments — says that the moment an endpoint has real buyers, it keeps them. The rational play is to make the experiment cost as little as possible (no code, no custody, no percentage fee) and to spend your effort on the product and discovery side, where the difference between $2.50 and a revenue line is actually decided. Payzum exists so that the payment layer isn't the part you spend on.

"The volume numbers were inflated. Isn't the whole rail a mirage?"

The headline numbers were inflated by a bridge and two loops; the audit went to the trouble of removing them and still found ~2.2 million honest payments a month, a processor collecting fees from real merchants, and a seller that a Fortune-scale data company chose to go live on a week earlier. A mirage doesn't have a 99.94% authorization-to-capture rate. The right response to inflated aggregate figures is to stop reading aggregates and look at per-seller retention — which is what this post does.