AI Agents Have Moved $73 Million on Crypto Rails. Nobody Knows Who Is Liable.
When an AI agent buys something on your behalf, nobody—not the vendor, not the network, not the regulator—has definitively said who is liable when something goes wrong. That has not stopped incumbents from deploying more than $8 billion in acquisitions to own the payment rails AI agents are already using.
A report from Keyrock, a blockchain finance infrastructure firm, found that AI agents have now settled over $73 million across 176 million transactions between May 2025 and April 2026, almost entirely in USDC, a dollar-pegged stablecoin. Ninety-eight point six percent of agent payments run through that one coin. The economics are striking: Layer 2 stablecoin settlement costs $0.0001 per transaction, and roughly 76 percent of agent activity falls below the $0.30 Visa card fee floor. For machine payments, the traditional card network is simply too expensive at the wrong end of the volume spectrum.
The legal infrastructure has not kept pace. MiCA, Europe's comprehensive crypto regulation, the GENIUS Act, and the EU AI Act all reach enforcement in mid-2026. None of them address autonomous machine-to-machine transactions. There is no settled definition of who is responsible when an agent pays for something the account holder did not explicitly authorize.
The exposure is concrete. Circle, which issues USDC, froze more than $75 million in wallets following OFAC orders in 2023 alone. If an AI agent routed a payment through a sanctioned address before a blocklist update landed, that frozen wallet could belong to the agent's human employer, not the agent vendor. The infrastructure is live. The liability map is not.
"We are building on a foundation that has not been built yet," is how one payments engineer at a major exchange described it, speaking on background because their employer declined to comment publicly on regulatory uncertainty.
The infrastructure that exists
Circle launched an Agent Stack on May 11, 2026, offering CLI tools, agent wallets, a marketplace, and nanopayments down to $0.000001 per transfer. The company says 119 million x402 transactions have processed on Base and 35 million on Solana, with the ecosystem carrying $600 million in annualized volume, according to AImonks. Over 104,000 agents are registered across more than 15 directories and registries.
Stripe, Capital One, Mastercard, and Bridge have all been acquired or acquired competitors in the last two years, more than $8 billion in total machine-payments deal value, suggesting incumbents believe the agents-are-paying-customers thesis enough to buy position ahead of definition.
Jeremy Allaire, Circle's CEO, predicted in January that billions of AI agents would operate with stablecoins on users' behalf within five years. If that timeline holds, the regulatory gap widens with it.
The enforcement timeline is not theoretical
Gartner projects AI agents could intermediate $15 trillion in purchases by 2028. McKinsey's estimate for retail agentic commerce alone sits at $3 trillion to $5 trillion by 2030. These are large numbers carrying large investment theses. They also assume a legal framework that does not yet exist for the transactions that would generate them.
AI agents already account for 37 percent of all Safe transactions on Gnosis Chain (a blockchain settlement layer) and rise above 75 percent on peak days, according to Keyrock. This is not experimental. The machines are already spending money.
The GENIUS Act, which passed the US Senate in modified form, designates stablecoin issuers as banks in some configurations. MiCA requires e-money token authorization in Europe. Neither act specifies whether an agent acting on instruction (rather than at direction) creates a new liability category, a new authorization entity, or simply a new execution path under existing law. A law professor at a major research university, who studies digital asset regulation and asked not to be named ahead of anticipated testimony, described the current state as "the most significant unresolved question in digital asset regulation, and nobody in the room is pretending otherwise."
What happens next
The practical risk is not hypothetical. As agentic payments scale, the probability approaches certainty that a high-value transaction will be disputed, reversed, or frozen, and that the parties involved will have incompatible readings of who authorized what. The smart contract may have executed correctly, the agent may have followed its instruction exactly, and the human may have assumed the agent would not act without confirmation. None of those facts resolve the legal question.
Three regulatory frameworks hit enforcement in weeks. None answer the central question. The $8 billion in deployed capital, the 176 million settled transactions, and the 104,000 registered agents suggest the market is betting the question resolves in its favor. The alternative is that the enforcement cliff arrives before the liability definition does, and somebody's legal team gets to write the answer on a whiteboard in a deposition.