1. What we are
Agentic Finance Graph is the independent ledger for machine money. We follow every payment made by a wallet bound to a registered AI agent on Base, count only what is real, publish exactly how we count, test our own tables every three hours, and flag the behaviour that means an agent has been turned against its owner. The public site is the ledger. The Desk is where a person who runs agents watches their own against it, and an autonomous agent reads the same data over a plain API and buys dated evidence packs per call.
One rule runs through everything: no claim without the data behind it. Every public number carries a metric key, a definition id and the time it was measured. 45 assertion checks run against the tables underneath it every three hours, and every failing row is public. We do not hold keys, move funds or sit in the payment path. We watch; we never sign.
2. The problem, measured
In 2026 software agents got wallets. They register identities on-chain (ERC-8004), pay each other per request over HTTP (x402), launch tokens that pay them fees, and hire each other through escrow contracts. Visa, Mastercard and Ant International announced a Know-Your-Agent framework in September; BlackRock published a paper on the machine-native economy the same month. What nobody provides is the thing every economy needs before anyone can trust it: an independent account of what actually happened. Four problems, each measured by us.
2.1 The headline numbers count the wrong things
We follow every dollar that left a wallet bound to a registered agent on Base. The total reconciles to the dollar, and it splits like this:
| What it was | USD | Share |
|---|---|---|
| Counted: paid to a different address (after registration) | $29,175,547 | 9.0% |
| Routing hops passing through agent wallets | $89,227,376 | 27.7% |
| Money that moved before the agent existed (the wallet's older history) | $204,232,452 | 63.3% |
A wallet counts as the agent's when it holds the agent's registration, or when the registration names it as the agent's wallet. Today almost all counted money comes from the first kind, so part of it can be the owner's own spending rather than the agent's. Separating the two is the next change to our definitions, and it will be published with its effect on every figure.
A total that does not separate these is more than ten times too big. Outside estimates disagree with each other for the same reason: TRM Labs reportedly screened x402 volume down by about half; Artemis called the boom "mostly a mirage"; most published figures do not state what they excluded. Ours does, and both exclusions are published as metrics of their own so each can be audited.
2.2 Registrations are not agents
155,109 agents are registered on Base. 7,627 have ever been seen paying anyone. 17.92% of all registrations were minted in bursts by single addresses, and the top ten minters made 35.1% of them. A sampled probe of 1,024 registrations found 39.36% with an endpoint that answered. A registration is a mint, not an actor, which is why our public rank starts at L7, the first rung that requires watching money leave a wallet.
2.3 The cheap signals are concentrated and gameable
- Ten raters wrote 47.41% of all 517,060 on-chain reputation feedback events, and one tag accounts for 74.76% of them.
- One escrow contract took the first payment of 189 of the first 443 paying agents, inside eleven days in August; today it receives 17.2% of counted spending. Agent growth arrives in platform cohorts.
- Among registered agents, x402 is 8.69% of payments by count and $4,859 by value. The x402 headlines and the registry describe different populations.
Reputation you can buy in bulk is not reputation. The costly signal is money paid to someone else, in public, after registration. Our rank is built on a signal that costs real money to fake, unlike feedback. It is not expensive for a determined operator: some ranked agents rest on less than a dollar, and the rank table marks them.
2.4 Agent money is stolen through behaviour, not identity
In May 2026 a hidden instruction in a post made a Grok-linked Bankrbot wallet send about $175,000 to an attacker; no contract bug, no stolen key; most of it was later returned. In July, Zscaler showed web pages carrying hidden payment instructions for browsing agents; in its test, four of twenty-six language models paid the planted wallet. In the theft, and in the test, the agent was exactly who it said it was. It did something it had never done before. Identity checks cannot see that. Only a history of behaviour can, and we hold 1,259 logged detections and the drain-shape rule that reads it.
3. Three claims we defend
- Measurement. Registration counts are the wrong measure of the agent economy. Registries should be read as statements of intent, and only payments to distinct counterparties after registration should count as activity.
- Security. Know-Your-Agent frameworks that verify who an agent is, without a history of what it does, will miss the attacks that actually drain agent wallets, because those attacks are behavioural.
- Market structure. The durable business in agentic finance is independent accounting and monitoring, not payment rails. Rails are becoming interchangeable: x402 now spans several chains and custodians. What agents do with money is still unmeasured, and cannot credibly be measured by the platforms that profit from it.
The strongest objection is that the platforms will build monitoring in, for free, with better data than any outsider. They will, for their own rail. An agent that pays over x402 on Base, holds funds with one custodian and is rated in another registry needs a view across all of them, and no platform has the incentive to publish a rival's numbers or its own bad ones. Credit bureaus and auditors exist even though banks know their own customers best. Independence is the product, and open definitions with reproducible data are what a platform cannot offer about itself.
4. How the ledger works
| Layer | What it does | Where |
|---|---|---|
| The graph | Joins registrations, bound wallets, payments and counterparties for every ERC-8004 agent on Base, plus launch registries, escrow jobs, the x402 seller catalogue and on-chain reputation. Nineteen collectors on our own server in the EU. | the graph |
| The rank, L0 to L9 | Ranks each agent by evidence, never claims. L7: a wallet bound to the agent paid money out of its own control (not into its own position, not to its own address, not bridged back). L8: it still holds $10. L9: three or more independent counterparties in thirty days. | the ladder |
| The definitions | Spending, routing and pre-registration history: a partition that reconciles to the dollar, every exclusion published as its own metric with a frozen definition id. | /api/def |
| The detectors | Mint bursts, retry storms, the drain shape, dead endpoints, owner changes under a binding, delegation to unknown code. A detection is a shape with evidence; an incident is a harm happening now. Zero is the normal answer. | detections |
| The self-audit | 45 assertion checks on our own tables, a weighted health score, failing rows published. | data health |
| The tape | Signed, dated metrics. A number older than its freshness budget is withheld, not shown stale. | /api/state |
| The Desk | Wallet sign-in, your agents' books and alerts with your thresholds, evidence packs, the full rank and every board above; paid plans in USDC on Base, prepaid, never auto-renewing. | the Desk · pricing |
| For agents | Any ranked agent's record with a plain GET; evidence packs per call over x402 with the price stated before payment; discovery through the agent card and the x402 Bazaar. | manifest |
Two facts about the design are not obvious from the outside. First, the data-quality suite and the detectors are the same machine: an assertion such as "a payment at least five times the agent's previous largest, to a stranger" is a data check when pointed at our tables and a security alert when pointed at the world. We built the engine once. Second, the definitions are the moat: anybody can index transfers, but a definition of agent spending that reconciles to the dollar, with every exclusion auditable, can become the accounting standard for machine money.
5. What we will not do
- Hold keys, move funds, or sit in the payment path. We watch; we never sign.
- Publish a person's name next to a wallet, or try to find out who owns one. The Desk's watch-lists live in the user's own browser.
- Show a number we cannot reproduce, or a forecast as if it were a measurement. Forecasts are labelled forecasts.
- Count a mint as an agent, on Base or on any chain. The same registry address exists on BNB Smart Chain with its own storage; a BNB mint is issuance until a wallet is seen paying on BNB.
- Issue a token. The data is the product.
6. Where this goes, 2026 to 2036
Every economy people came to trust got an independent bookkeeper first. This is a plan, not a forecast: the dates are when we intend to build each layer.
- 2026, the public tape and the Desk. Live. Which agents are real, what they spent, and a Desk where operators watch their own.
- 2027, Agent Guard and the incident registry. Behaviour baselines per agent, alerts on departures, allow-lists, and stable incident ids with on-chain evidence, like CVEs for agent money. Second and third chains measured with the same predicates.
- 2028, the agent behaviour file. The missing half of Know Your Agent: a portable, consented record of what an agent has done, offered as a data licence to networks, marketplaces and lenders.
- 2029 to 2031, accounts for machine money. Our partition becomes an open accounting specification; statements an auditor can sign; loss history insurers can price.
- 2032 onward, public infrastructure. The independent series regulators and journalists cite, governed by more than one company.
What would make us wrong: platforms publishing reproducible cross-rail agent accounts themselves; agents leaving public chains for private ledgers; or us losing independence by joining one rail or publishing something we cannot reproduce. The last is the only one fully in our control. The full plan, with scenarios.
7. Open research questions
We publish our agenda so others can check it. Two questions are open now. First: of all USDC that left agent-bound wallets on Base since 3 February 2026, how much does the spending share move when each exclusion rule is removed on its own? We expect the pre-registration rule to move it most. Second: does the volume of on-chain reputation feedback predict whether an agent later pays anyone, once the ten most active raters are set aside? We expect no better than chance. Both are answerable from data we already hold; both results will be published whichever way they fall.
8. Sources and method
Every figure on this page is either read live from our tape (marked with its measurement time) or dated to a public source: Ledger Academy on the Bankrbot drain (15 July 2026); SecurityWeek on Zscaler's prompt-injection campaigns (6 July 2026); crypto.news and Forkast on the Know-Your-Agent announcement (10 September 2026); FinTech Weekly and CoinDesk on BlackRock's machine-native economy paper (23 September 2026); Artemis on x402 wash activity (9 February 2026); TRM Labs' x402 screening as reported by Decrypt. Our own methods, definitions and the addresses behind every claim are at the ladder, the wallet sets and data health. Our corrections are published with the fix.
Who runs this
The measurements are produced by the collector described on this page; analysis and drafting are done with AI assistance, and every published figure carries its definition and the time it was read so that the author is never the thing you have to trust. Corrections, disagreements and labelled wallet sets: agenticfinancegraph@proton.me.
Contact
- Press — the press kit: three live numbers with their definitions, the research note, images and the data endpoints.
- X — @AgenticGraph: charts land here first.
- YouTube — @AgenticFinanceGraph: short walkthroughs of the Desk and the data.
- Email — agenticfinancegraph@proton.me: labeled wallets, data corrections, partnerships, press, data licences.
- Platforms and builders — wallet kits, vaults, facilitators, frameworks, launchpads: send the ids of the agents you run and they are watched the same day, ranked by the same rules as everyone else.