How to read this page
This is a matrix, not a ranking. Every provider is scored on the same six columns, and two of them carry most of the weight.
- Custody model — who can sign without asking. User key: a human or hardware device holds it. TEE: the provider’s enclave holds it and the agent calls an API. Session key: a delegated, scoped, revocable key. God-key: the raw private key lives in the agent runtime.
- Policy enforcement location — what refuses a bad transaction. Chain module: a contract refuses. Wallet API: the provider’s server refuses before signing. Prompt: the model is asked nicely. Only the first two are policies.
- Chains, settlement asset and open-source status follow. Two graph columns — last live endpoint check and incident count — change daily and are served from the graph, not frozen here.
Cells marked “research pack” come from the Agentic Finance Graph research pack (2026-09-04) and were not re-verified against vendor pages today. Three entries were: Coinbase (launch report, 2026-02-11), Cloudflare (press release, 2026-08-04) and Turnkey (policy documentation, read 2026-09-04).
The provider matrix: 13 agent wallets
| Provider | Custody model | Policy enforced at | Chains | Settlement | Open or closed | Notes and limits |
|---|---|---|---|---|---|---|
| Coinbase — Agentic Wallets, AgentKit, CDP | Provider-held; keys never leave Coinbase infrastructure (launch report, 2026-02-11). TEE plus 7702-style smart account per research pack. | Wallet API — limits “enforced at the infrastructure layer before anything executes”. Optional chain module via CDP EIP-7702 delegation. | Base first; Solana via AgentKit; sponsored 7702 on Base, Arbitrum, Ethereum, Optimism, Polygon | USDC, gasless on Base; native x402 | AgentKit open; wallet service closed | Launched 2026-02-11. npx awal CLI. Per-session and per-transaction caps. |
| Privy — Agentic Wallets | Provider-managed signer (research pack) | Wallet API (research pack) | EVM and Solana (research pack) | Any token; USDC typical | SDKs open; signing service closed (research pack) | Embedded-wallet vendor. The policy is Privy’s server, not a contract. Not re-verified 2026-09-04. |
| Circle — Agent Stack, Nanopayments | Provider-held or user-controlled Circle wallet (research pack) | Wallet API (research pack) | USDC chains; CCTP burn-and-mint between them | USDC native; sub-cent tickets via Nanopayments (research pack) | Closed service; x402 Foundation member | CCTP means the wallet never has to hold a gas token. |
| Turnkey | Provider-hosted signer; enclave per research pack | Wallet API — JSON policies with effect, consensus, condition, evaluated on each request (docs, 2026-09-04) | Chain-agnostic signer (research pack) | Any | SDKs open; policy engine closed | Documented example condition restricts eth.tx.to. Chain, contract, selector, address and value granularity per research pack. consensus adds a human quorum. |
| Cloudflare — Wallets, cloudflare.pay | Provider-held. The Account Wallet is the human’s central balance; Virtual Wallets are assigned to agents (press release, 2026-08-04) | Wallet API — spending cap, approved-merchant list, per-transaction maximum | Not named in the release | Stablecoins, network unnamed; seller side via Monetization Gateway | Closed; x402 Foundation member | Announced 2026-08-04. Handle reservation open; on- and off-ramp promised for the coming months. |
| MoonPay — PayBox, Agents | Provider-held (research pack) | Wallet API (research pack) | Card rails plus crypto networks (research pack) | Cards and crypto | Closed; MCP and CLI surfaces | Only entry spanning fiat cards and crypto in one agent surface. Not re-verified 2026-09-04. |
| Trust Wallet — Agent Kit (TWAK) | User key; the kit executes from a self-custody wallet (research pack) | Wallet-side, not chain (research pack) | 25+ | Any | Kit open (research pack) | ERC-8004 work in progress. Widest chain list in the set. |
| Ledger — Device Management Kit | User key on hardware. Agent proposes, human confirms. | Human, on the device screen | Multi-chain | Any | Kit open (research pack) | Throughput bounded by a person, by design. Ledger documented a 2026 agent-manipulation loss of about $175k (research pack). |
| Safe — modules | Owner keys on a smart account; the agent holds a module or role with scoped rights | Chain module | EVM — Ethereum, Gnosis, Base, others | Any | Open | Agents at roughly 37% of Safe transactions, above 75% on peak days — research pack, window unpublished, not re-confirmed 2026-09-04. |
| MetaMask — Agent Wallet | User key plus delegation framework; the 7702 implementation is among ethereum.org’s audited examples (research pack) | Chain module, plus wallet-side simulation, threat scanning and MEV protection. Guard Mode holds human approval thresholds; Beast Mode runs autonomously inside allowlists. | EVM | Any; ERC-7821 batch swaps | Delegation framework open (research pack) | Plugs into Claude Code, Codex, OpenClaw, Hermes and Cursor (research pack). |
| Alchemy — Agent Wallets | User key plus session key: 7702 delegate → wallet_createSession → one EIP-712 signature → agent signs with the session key only | Chain module (modular account); some permission checks hybrid or off-chain (research pack) | EVM | Any | Modular account open (research pack) | Permission types: native-token-transfer, erc20-token-transfer, gas-limit, contract-access, functions-on-contract. |
| Finance District — Agent Wallet | TEE keys | Wallet API (research pack) | EVM, Solana, Bitcoin — all provisioned at signup | Any; USDC typical | Closed (research pack) | MCP-native. Only entry listing Bitcoin at signup. |
| Binance — Agentic Wallet, AI Agent Skills | Exchange-side custody (research pack) | Exchange API controls (research pack) | BNB Chain and exchange-supported networks (research pack) | USDT, USDC, exchange balances (research pack) | Closed; skills published | BNB Chain also carries most ERC-8004 mints and most of the spam, so provenance labels matter here. |
What the matrix says
Three clusters fall out.
Provider-held wallets with API-side policy — Coinbase, Privy, Circle, Turnkey, Cloudflare, MoonPay, Finance District, Binance. Provisioning takes minutes, gas is abstracted, and the agent never sees a key. The cost is that the policy is a server you do not run. Coinbase’s phrasing — caps enforced at the infrastructure layer before anything executes — is accurate, and it is also the definition of a wallet-API label: nobody outside the vendor can audit the cap on-chain.
Self-custody with on-chain delegation — Safe modules, MetaMask Agent Wallet, Alchemy Agent Wallets. The policy is a contract anyone can read. EIP-7702 has been live since Pectra on 2025-05-07, and both MetaMask’s delegation framework and Alchemy’s modular account appear among ethereum.org’s documented audited implementations (verify live before relying on an address). The costs are gas, EVM-only reach, and one fact no marketing removes: delegation is not custody transfer. The master key can always replace the code, so it must live outside the agent.
A human confirms — Ledger’s Device Management Kit, and MetaMask in Guard Mode. Throughput is bounded by a person. That is the point. Ledger documented a 2026 case in which an agent was talked into moving roughly $175k by a hidden instruction — not a stolen key, a persuaded agent (research pack, 2026-09-04). The countermeasures are in the agent wallet security checklist.
Payment rails: x402 vs MPP vs card-network agent pay
A wallet decides who signs. A rail decides what the counterparty accepts.
| Rail | Governance | Settles in | Typical ticket | Refunds | Measured |
|---|---|---|---|---|---|
| x402 | Coinbase origin; Linux Foundation stewardship; 40 members including AWS, Google, Visa, Mastercard, Stripe, Circle, Cloudflare, Shopify, Solana Foundation (research pack, 2026-09-04) | USDC — EIP-3009 gasless on Base; also Solana | cents | None native; no chargeback in an HTTP 402 | ~99% USDC on measured flow; 50M+ transactions reported at the Coinbase launch, 2026-02-11 |
| MPP — Stripe, Tempo | Stripe and Tempo | Cards, crypto and Lightning in one HTTP flow | cents to dollars (research pack) | Card path inherits card disputes | No public receipts explorer |
| Visa / Mastercard agent pay | Card networks; verifiable credentials and vouchers (research pack) | Fiat over cards | larger tickets | Yes — refunds and chargebacks | No agent-attributed public volume |
x402 is where the receipts are. The flow we can measure settles about 99% in USDC — a monoculture, not a market — and the typical ticket is cents. Cards cannot price a three-cent API call; that is the whole reason x402 exists. MPP from Stripe and Tempo answers a different question: one HTTP flow that can settle on cards, crypto or Lightning, so the seller does not have to choose a rail. Visa and Mastercard agent-pay schemes keep what cards are good at — larger tickets, refunds, disputes — and inherit what they are bad at: per-call pricing and public receipts. Flow statistics live on the x402 page and in the 2026 payments statistics.
Which to pick for which job
- Cents-per-call spend on APIs, inference and data. Coinbase Agentic Wallets or a Cloudflare Virtual Wallet over x402. Gasless USDC, caps enforced before signing, no human per call. Cloudflare’s chains and ramps were unnamed or pending at announcement (2026-08-04); check before funding.
- A fleet of internal agents with per-team budgets. Cloudflare: one Account Wallet, many Virtual Wallets, an approved-merchant list and a per-transaction maximum. The corporate-card model, built as a wallet.
- Treasury, vault deposits, anything above a few thousand dollars. A Safe module or a 7702 session key (Alchemy, MetaMask) with the master key on a Ledger. A leak costs a valet key. Where the idle cash then goes is covered in yield agents and ERC-4626 vaults.
- Embedding wallets in your own product. Turnkey when you need an explicit policy language and a human quorum; Privy when the wallet must be invisible to end users. Both are API-enforced — label them that way.
- Solana or Bitcoin alongside EVM. Finance District (all three at signup), Trust Wallet Agent Kit (25+ chains) or Turnkey (chain-agnostic). Safe, MetaMask and Alchemy stop at the EVM.
- Consumer purchases that may need a refund. MoonPay’s card path or a card-network agent-pay scheme. Not x402.
- Exchange-native trading. Binance Agentic Wallet with AI Agent Skills. Fast, but it is exchange custody, and the graph labels it as such.
The wiring for each path is in how to connect an AI agent to a web3 wallet.
How Agentic Finance Graph labels each provider
Every funded, labeled agent wallet in the graph carries the same fields. The matrix above seeds them.
custody∈ user_key · tee · session_key · god_key. Coinbase, Circle, Finance District, Cloudflare and Turnkey seed asteeor provider-held; Alchemy and MetaMask assession_key; Ledger, Trust Wallet and Safe owners asuser_key.policy_enforcement∈ chain_module · tee · api_gateway · prompt. Safe, MetaMask and Alchemy seed aschain_module; every hosted wallet above asapi_gateway. A wallet whose spend cap lives in a system prompt isprompt, and we say so.- God-key flag. A raw EOA holding agent-sized USDC with no delegation, no session key and no signer isolation. A first-class incident precursor, not a style note. Detection is the
0xef0100code check from the EIP-7702 brief. implementation_risk = unknownfor any 7702 delegate not on the audited list;hitl = truefor Ledger and Guard Mode paths.- Liveness is scored separately on the L0–L9 ladder. A provider launch adds no rungs. A funded wallet with repeat counterparties does.
What this comparison cannot tell you
Launch dates are not volume. Apart from x402, whose receipts are public, no provider above publishes agent-attributed volume with an object definition and a window, so this page ranks custody design, not usage. The Safe share figure is research-pack data we could not re-confirm on 2026-09-04; treat it as directional. And registrations are not agents: of the ERC-8004 registrations counted in July 2026, 2.24% had a working service (Token Dispatch, “Who Checks the Agents?”, July 2026). A provider with a thousand wallets may have ten economic actors. That distinction is what agentic finance means and what the graph counts; market-size claims get the same treatment in forecasts vs measured reality.
Sources
- Cloudflare press release, “Cloudflare gives AI agents an identity and a wallet” — 2026-08-04 — link
- Genfinity, Coinbase Agentic Wallets launch report — 2026-02-11 — link
- Turnkey documentation, Policies overview — read 2026-09-04 — link
- x402 Foundation — research pack, 2026-09-04 — link
- x402 protocol repository — research pack, 2026-09-04 — link
- x402scan explorer — research pack, 2026-09-04 — link
- Coinbase CDP x402 documentation — research pack, 2026-09-04 — link
- Coinbase CDP EIP-7702 documentation — research pack, 2026-09-04 — link
- Coinbase AgentKit repository — research pack, 2026-09-04 — link
- ethereum.org, Pectra EIP-7702 page with audited implementation examples — research pack, 2026-09-04 — link
- EIP-7702 specification — research pack, 2026-09-04 — link
- Keyrock, “Who Pays the Agent” — research pack, 2026-09-04 — link
- Onchain Agents index (satohubai) — research pack, 2026-09-04 — link
- Agentic Finance Graph research pack — 2026-09-04 — link
FAQ
Which AI agent wallet is best?
No single one. Choose by custody model and policy enforcement location. For cents-per-call spend, a provider-held enclave wallet with API-side caps and native x402, such as Coinbase Agentic Wallets or Cloudflare Wallets. For treasury, a chain-enforced session key or a Safe module with the master key on hardware. Never a raw private key inside the agent runtime.
Coinbase vs Privy vs Turnkey: which one should a developer use?
All three hold the signer for you and enforce policy in their own API. Coinbase is the fastest path to gasless USDC on Base and native x402; Agentic Wallets launched on 2026-02-11. Turnkey has the most explicit policy language we reviewed: JSON policies with effect, consensus and condition fields, evaluated on each request. Privy is an embedded-wallet vendor whose agentic wallet details we hold only from our research pack; check current documentation before relying on them.
x402 vs MPP: what is the difference?
x402 is an open HTTP 402 payment protocol with Coinbase origin and Linux Foundation stewardship, 40 members, settled about 99 percent in USDC on the flow we can measure. MPP from Stripe and Tempo puts cards, crypto and Lightning inside one HTTP flow. x402 has public receipts; MPP volume is not publicly attributable to agents yet.
What is a god-key agent wallet?
A wallet whose raw private key sits in the agent runtime with no delegation, no session key and no signer isolation. A prompt injection then yields the whole balance, not a capped slice. Agentic Finance Graph flags funded, labeled agent wallets in this state as incident precursors.
Does EIP-7702 delegation make an agent wallet safe?
It makes policy possible, not automatic. The master key can always replace or clear the delegated code, and a malicious implementation runs with the full balance. Safety is an audited delegate plus keeping the raw key out of the agent runtime. EIP-7702 has been live since Pectra on 2025-05-07.
Which agent wallets cover Solana or Bitcoin as well as EVM chains?
Finance District provisions EVM, Solana and Bitcoin at signup. Trust Wallet Agent Kit lists 25 or more chains. Turnkey is chain-agnostic. Coinbase AgentKit reaches Solana. Safe modules, MetaMask Agent Wallet and Alchemy Agent Wallets are EVM only. Chain lists are per the research pack dated 2026-09-04.