Martín. Stablecoin and payment infra on EVM and Solana. I also break DeFi protocols in audits. 18 open-source protocols shipped. 23 findings with working PoCs on a private audit. 4 in contests this year, 3 High. Site: martincasais.com Labs: labs.martincasais.com

I'll believe in personal agents the day one renews my driver's license. Not pizza. Not a flight. The DMV. Captcha, 2FA code to my phone, a form that only submits in Chrome and a PDF I have to print and sign. Every demo picks the one errand on earth that has an API, then calls it autonomy.

Tether has made more money than any company in crypto and still refuses to ship 40 lines of Solidity. USDC added permit in 2020. You sign once, no approve, no ETH. USDT never did. So in 2026 your mom still has to buy ETH to send dollars, every approve takes two transactions, and every wallet on earth carries a special case in its code just for Tether. They earn billions a year on treasuries. The approve screen is your problem, not theirs. Everyone building gasless flows is doing free engineering for the richest company in the industry.

Everyone's reading the stablecoin stall wrong. Supply flat at $300B for months. Standard Chartered just pushed its $2T call to 2030 because of it. Looks like demand died. Same report: each stablecoin dollar now moves 30 times a month. A year ago it was 15. So the dollars stopped piling up and started doing work. That's not a stall, that's the point. Nobody measures Visa by how much cash sits in checking accounts. Flat supply with doubling velocity is the most bullish chart in crypto right now and it's being reported as bad news.

Everyone pitching x402 as no chargebacks is skipping one line of code. USDC has a blacklist function. It has been there since the first deploy. Circle makes one call and the agent's wallet is frozen, with every payment it was ever going to make. Visa reverses one transaction after a dispute. Circle can reverse an entire wallet and nobody has to file anything. So the chargeback is still there. It just belongs to one company now and you can't appeal it. Finality for the merchant. Not for you.

Hyperliquid, the no VC chain, sold $330M of HYPE to a VC last week. Nobody noticed because they called it OTC. OTC just means the team got paid and you don't get to see the fill. 3.75M tokens went out. The biggest unlock before this was 534k. The buyer is anonymous, the price is private, and a quarter of the stack was back in staking the same day collecting yield. HYPE still fell 8%. Any other team sells a third of a billion to one wallet and the timeline screams rug. This one got thanked for it. Turns out insider sales are fine as long as you hold the coin

The scariest part of bunker mode isn't the math. It's the plan. Nobody has broken a single ECDSA signature. Not one coin. What does get stolen, every month, is money people move in a hurry. September: $768M gone. Zero of it from a quantum computer or an AI. And the fix on the table is telling a few million people to do the one irreversible thing in crypto, at the same time, scared. Clipboard malware doesn't need to break ECDSA. It just needs you to migrate. If the curve dies one day, it dies. Rushing it today only means getting robbed a year early.

Ledger told the people who lost $86M this week to not open the box $150 for the safest way to store crypto, and the official advice is to leave it in the packaging

People who did everything right got drained for 86 million this week. They bought a Ledger. From the official reseller. Kept it offline. Gone anyway. Ledger's advice on friday, in its own words: if you bought from CryptoBilis in the last 90 days, do not set up the device. The company that sells you cold storage telling you to leave it in the box. Let that one sit for a second. Nobody knows yet how it happened. What's clear is the standard advice, buy official, go cold, don't click links, has a hole in it the size of a shipping route. Your seed is as private as the last stranger who touched the package. So, the one in your drawer. Did it generate the seed in front of you or was it already written down somewhere?

x402 did 1.28M payments on Aug 26. 145 wallets. 3 recipients. That one day is a fifth of the whole 35 day sample someone just published. 6.4M payments, $119,900 in total, 9 out of 10 under a cent. The 75M a month number everyone keeps quoting is mostly this What gets me is x402 exists precisely so you can't do this. One request, one transfer, demand you can count onchain. Nobody said anything about who's counting I've had endpoints behind a 402 for a while. Real agents that paid: a handful. I could write a script tonight and be the biggest x402 merchant on Solana by morning, and every dashboard would say the agent economy is booming Three addresses got paid 1.28M times in a day. Not a market, a load test

Solana just added a prepaid balance to x402. Which is funny because not having one was the point BlockRunAI numbers: 18.5M calls a month, one USDC transfer per call, $18,400 in fees. So now the customer deposits into a channel first, each call signs an IOU, and the merchant claims the pile whenever I've gated endpoints with 402 and the loop was one request, one transfer, nothing parked anywhere, nothing owed. Try doing that at 18M calls and apparently it's an $18k bill Fine, batching makes sense. But deposit first, settle later, trust the counterparty in between. The agent got a bar tab

Vitalik just admitted he's lost more money moving wallets than to every hack in his life. Same day he told you to think about moving yours. The bunker mode plan is: send your coins to an address that has never signed a tx. A million agent wallets are about to sign all day for a living. Nobody's bunkering those. Humans get told to hide. The bots get an upgrade.

You can buy the XRP Ledger's "10 million x402 payments" milestone for $150. That's the math. 10 drops per tx, 10 million txs, 100 XRP. Ripple's head of engineering announced it like a number that cost something. Not one of the posts about it says how many dollars moved. Because that number would be small enough to kill the story. Every chain in this race is reporting payment count now. Count is what you report when volume is embarrassing

x402's best day in six months was a hackathon. $223k on Oct 2. 72% of it on Algorand, where the Foundation is paying people to send x402 transactions this month. Strip that out and the agent economy did about $60k. Same number it was doing in the spring, while everyone from Visa to Sui to the XRPL got on stage in Singapore to say they're ready for it. Nobody's lying. The supply side is real. There just isn't a demand side yet, and a chart that goes up because a foundation wrote a cheque doesn't change that. Check Algorand's share on Nov 1

The x402 chart doing the rounds this week is fake. Not wrong, fake. $223K on October 2, best day since April. 72% of it is one chain, Algorand. Algorand has a leaderboard running. Most x402 volume on your endpoint wins a cut of $100K and 500K ALGO. Daily settlements went 1,300 to 40,600 in five days once that went live. Read that again. The protocol built so nobody needs to farm anything just had its best day because people are farming it. Nobody's agent woke up and decided to buy something. A hundred devs are paying their own endpoints with their own USDC and sending each other the screenshot. Strip Algorand out and x402 had a normal day.

x402 lets an agent spend a whole wallet in 400 requests with nothing but its own signature. my bank still texts me a 6 digit code to pay 9 dollars for lunch. we spent ten years calling that friction. turns out it was the fraud department.

x402 is turning into Stripe. Slower, worse docs. First year the homepage said no subscriptions, no prepayments, no lock-in. Second year we got session tokens, balances, refunds. Someone is shipping chargebacks on top of it as I type this. I think the honest version is that pay per request was never going to survive contact with a real agent. Looks great in a demo. Then your agent calls the same endpoint 40,000 times before lunch and you figure out what a subscription actually was, a cache for payments. So every feature since has been the protocol slowly remembering why cards work the way they do. And the one thing the pitch depended on, telling an agent apart from a cron job, still isnt in the spec. Thirty years waiting on HTTP 402 and we used it to rebuild Visa with extra steps.

x402 was built so an agent could pay for something without having an account. Coinbase just shipped it as a feature of your brokerage account. Read the launch post again. The agent pays a cent for a sentiment feed, then buys the stock. Same balance. Same login. Same key. 230M x402 transactions, $54M in volume. Do the math, that is 23 cents per payment. That is what the protocol was designed to protect. Now it sits next to your NVDA position, and the sandboxed equities accounts are coming soon, their words, which means today they do not exist. I build on x402 and the one rule I never broke is that the agent paying for data does not hold the key that moves real money. The entire security model is that the worst case is a lost cent. Coinbase took the thing that made agent payments safe and used it as the onboarding for agents trading your portfolio. If the agent hallucinates on a Tuesday night, it is not a 23 cent problem anymore. Half of all x402 traffic runs through Coinbase. They are not building the agent economy. They are building a brokerage where the client never sleeps and never says no.

Been staring at Kalshi's ETH perp numbers for an hour and I can't make them make sense. $538M traded yesterday. $3M open interest. Whole book flips every 8 minutes. So I pulled the trades. 59% of the volume is one $5,500 clip. Gets hit, back on the book 117ms later, hit again. 469k times in two weeks. Then it clicked. Kalshi pays market makers $110k a month to keep quotes up. Self clearing traders hit those quotes with zero fees. One side is paid to post, the other pays nothing to take, and every round trip counts as volume. It's not a bug, it's the incentive design doing exactly what it says. Kalshi's own market maker is also a self clearing member. No way to tell from the tape if it's in there. And they're raising $1B at $40B on that volume number. We clowned on offshore exchanges for years for doing this with bots. Didn't know you could do it with a CFTC license

El Salvador made every shop take bitcoin by law and 5 years later Bukele is quietly moving to stablecoins. Turns out even the bitcoin country would rather spend dollars

Built AutonomiX on EVM as a side project. Now it's the Week 6 challenge in Solana Audit Arena, ported to Solana, and researchers have 7 days to break it. First arena challenge with an off-chain component. The x402 relay is the new attack surface. Start there. Fastest way to learn agentic payments is breaking one.