AI Agent Wallets: How to Give an AI Agent a Crypto Wallet With Spending Limits (2026)

In May 2026, a hidden message posted on X got a Grok-linked Bankr wallet to send about 3 billion DRB tokens on Base. Cointelegraph put the loss at $155,000 to $174,000. Nobody stole a private key. The agent was simply talked into it, and its wallet had no rule that said no.

That is the core problem with an AI agent crypto wallet. The agent needs enough spending power to be useful, but not enough to be dangerous. Coinbase, MetaMask, Circle and AWS all shipped agent wallet tools in 2026, and each one puts the brake in a different place. This guide shows you the three ways to hold the keys, how to set spending limits that really hold, how x402 payments fit in, how to stop prompt injection, and what it costs to build or buy.

In this guide:

• The agent never holds the key. It asks a signer to act, and a rule-based policy engine checks every request before anything is signed.
• Set three caps, not one: a limit per payment, a rolling 24-hour limit, and a small funded balance. Your worst case is the smaller of the balance and the daily cap.
• Signed messages are the usual gap. MetaMask’s outflow limit does not count Permit2 signatures, and Coinbase’s server wallet accepts any operation that has no rule. Deny typed-data signing unless you allow it on purpose.
• x402 lets an agent pay per API call in USDC. Coinbase’s facilitator is free for the first 1,000 on-chain payments a month, then $0.001 each.
• Signature fees decide build vs buy. At 100,000 signatures a month, published vendor plans run from about $2,500 to $10,000, which is when owning the stack starts to pay.

What Is an AI Agent Crypto Wallet?

An AI agent crypto wallet is a wallet that software can use on its own, within limits a person sets in advance. The agent decides what it wants to pay for. A separate signer holds the key, checks the request against your rules, and signs only if every rule passes.

This is different from a trading bot with a private key in a config file. A bot like that can do anything the key can do. An agent wallet splits the job in two: the model asks, the policy engine decides. No text the model reads can change the rules, because the rules engine does not read text.

Teams give agents wallets for four main jobs:

• Paying for tools: buying data, API calls and compute per request, often over x402.
• Trading: placing on-chain swaps or orders. Our guide to the AI crypto trading agent covers the trading side in full.
• Treasury chores: paying invoices, topping up gas, sweeping funds to cold storage.
• Agent to agent: one agent paying another for a finished task.

It is also not the same as wallet-as-a-service for people. Those wallets assume a human taps “confirm”. Agent wallets assume nobody is watching, so the rules must do the watching.

Who Shipped Agent Wallets in 2026

The big wallet and cloud firms all moved this year. Here is what each one offers, as of October 2026.

Product	Launched	Who holds the key	Spending controls	x402
Coinbase Agentic Wallets	February 2026	Keys stay on Coinbase’s infrastructure; the agent never sees them	Caps per session and per payment, KYT and OFAC checks	Yes, core feature
MetaMask Agent Wallet	Early access, 8 June 2026	Self-custody; server wallet keys sit in a secure enclave (TEE)	Guard Mode, rolling 24-hour outflow limit, 2FA, threat scans	Yes
Circle Agent Stack	11 May 2026	Circle Agent Wallets	Spending policies; Arc chain added 16 Sept 2026	Yes, plus sub-cent nanopayments
AWS Bedrock AgentCore Payments	Preview, 7 May 2026	A Coinbase wallet or a Stripe Privy wallet	User sets spending limits per session	Yes
Stripe and Tempo (MPP)	18 March 2026	Privy wallets	Scoped, time-limited payment tokens	Uses its own Machine Payments Protocol

A widely shared comparison of five agent wallets on Reddit in August 2026 summed it up well: everyone has solved “the model must not hold the key”, but they differ on where the brake goes. Coinbase checks rules before signing. Circle’s setup puts a human share in the signature. MetaMask adds 2FA when a payment breaks the limit. One provider skips a rules engine entirely and treats the funded balance as the ceiling.

Custody Models: MPC, Secure Enclaves or Smart Accounts?

There are three ways to hold an agent’s keys. Most serious setups mix two of them.

Secure enclave (TEE) server wallets

The key lives inside sealed hardware and only signs there. The policy check runs inside the same enclave, so the rules and the key sit together. Privy’s docs say its enclave checks every policy before it signs or exports a key. MetaMask’s server wallets also keep keys in a TEE.

Good for: fully unattended agents that pay often and fast. Watch out for: you trust the provider’s hardware and uptime, and default rules differ by provider.

MPC wallets

The key is split into shares that sign together, so no full key ever exists in one place. A common agent setup is 2-of-2: the agent’s signer holds one share and the provider holds the other. A stricter setup gives a human one share, so nothing moves without a person. Coinsclone’s MPC wallet development page explains share setups in more depth.

Good for: treasuries and firms that want shared control and a clean recovery path. Watch out for: a human share means the agent cannot act alone, which suits large payments but not per-call micropayments.

Smart accounts with session keys

Here the wallet is a smart contract, and the rules live on-chain. You give the agent a separate session key that can only do what you granted. With MetaMask’s ERC-7715 permissions, for example, a user can sign a grant that lets an app spend up to 10 USDC a day, and the limit resets each day.

The base standards are settled. ERC-4337 and EIP-7702 are both Final on eips.ethereum.org, and EIP-7702 has been live on Ethereum since 7 May 2025. The permission standards are not. ERC-7715, ERC-7710, ERC-7579 and ERC-6900 were all still Draft on 16 October 2026, and MetaMask has already renamed its method once.

Good for: limits that hold even if the signing service is hacked, since the chain enforces them. Watch out for: gas, one deployment per chain, and standards that may still change.

Model	Where the rules live	Fully unattended?	Best fit
TEE server wallet	Inside the enclave, before signing	Yes	Frequent small payments
MPC, agent plus provider	Provider’s policy engine	Yes	Teams that want shared control
MPC with a human share	In the signature itself	No	Treasury and large payments
Smart account session key	On-chain contract	Yes	Hard caps you can prove

How to Set Spending Limits on an Agent Wallet

The policy engine is the real product. Build it as a list of rules that each request must pass, and reject anything no rule allows.

Default deny: start from “nothing is allowed”, then open what the agent needs. Privy and Turnkey deny by default, and an explicit deny beats any allow.

Per-payment cap: the most a single payment can be. Set it in dollars, not raw token units, so a price move does not quietly change the limit.

Rolling 24-hour cap: total value out in any 24 hours. MetaMask’s outflow policy works this way and asks for 2FA when a payment would break it.

Funded balance: keep only a small float in the agent’s wallet and top it up from a treasury the agent cannot touch. This is the brake that never fails.

Allowlists: name the recipients, contracts and chains the agent may use. For a research agent that buys data, that might be a dozen sellers and nothing else.

Rate limits: cap payments per minute. Builders on Hacker News warn about loops that drain a wallet overnight, and a rate limit stops a loop long before a daily cap would.

Human approval: small payments run on their own. Anything above a threshold, or to a new address, waits for a person.

Simulation and screening: simulate each transaction before signing, scan it for known threats, and check addresses against sanctions lists.

Expiry: session keys and grants should expire, so a forgotten agent loses its power on its own.

The traps that break spending limits

• Signatures that move money: a Permit or Permit2 signature can let a contract pull tokens later, with no transaction now. MetaMask’s outflow limit does not count Permit2 signatures today. Block typed-data signing unless a rule allows a named contract.
• Default allow on unlisted actions: Coinbase’s server wallet policies accept an operation when no policy has rules for it. A rule on sending transactions does nothing for message signing, so add a rule for every operation.
• Swaps count twice: MetaMask counts USDC to ETH, then ETH to DAI, as two outflows. Size your daily cap for the full route.
• Gaps between rails: a cap on the wallet does not cover an API key, a card or an exchange account the agent can also reach. List every way the agent can spend.

Worked example: what a hijacked agent can lose

Take a research agent that buys data over x402. The company treasury holds $50,000. Here is the worst case if an attacker takes over the agent and nobody notices for a full day.

With no limits, the agent signs from the treasury and the attacker can take all $50,000. Give the agent its own wallet with a $500 float, and the worst case drops to $500. Add a $100 rolling daily cap and it drops to $100. Add an allowlist of known data sellers, and the attacker cannot receive funds at all; the worst case is $100 of wasted spend at sellers you already trust.

How x402 Payments Work With an Agent Wallet

x402 is an open standard that lets a web service charge per request using the old “402 Payment Required” status code. Cloudflare and Coinbase announced the x402 Foundation on 23 September 2025, and AWS and Block have since joined the effort.

Here is one paid request, step by step:

1. The agent asks for a paid resource, such as a data feed.
2. The server replies 402 with a `PAYMENT-REQUIRED` header listing the price, the payee and the accepted tokens.
3. The policy engine checks the payee, the amount and today’s total. This is where your limits act.
4. The wallet signs and the agent resends the request with a `PAYMENT-SIGNATURE` header, per the x402 v2 spec.
5. A facilitator verifies and settles the payment on-chain, and the server returns the data with a `PAYMENT-RESPONSE` header.

Coinbase’s facilitator supports Base, Polygon, Arbitrum, Monad, World and Solana. It is free for the first 1,000 on-chain payments a month, then $0.001 each, and it screens payments against OFAC and KYT lists. It offers an `exact` scheme for fixed prices and an `upto` scheme where the agent authorises a maximum and pays only for what it uses. Use `upto` with care: the maximum, not the expected price, is what your cap must allow.

Keep the volume claims in proportion. Coinbase says it has processed more than 100 million x402 payments. However, CoinDesk reported that x402 moved only about $24 million in July 2026, and one Coinbase estimate put 25% to 30% of that down to leaderboard farming. Real demand is growing, but it is still early.

Prompt Injection: How Agents Get Talked Out of Funds

Prompt injection is when text the agent reads carries hidden orders. OWASP ranks prompt injection first and excessive agency sixth among risks for language model apps. An agent with a wallet has both.

The Bankr case shows how it plays out. The attacker first sent the wallet a free membership NFT that reportedly unlocked more rights. Then a hidden, Morse-coded message got Grok to repeat a transfer order, and the wallet’s automation treated that reply as a real command. Two design choices failed: a token anyone could send changed what the wallet could do, and model output went straight to execution.

Other routes to watch:

• Tool results: a web page, API reply or 402 response can carry instructions.
• Memory: notes the agent saves can be poisoned and act days later.
• Fake sellers: a paid endpoint can quote a high price or a new payee address.

How to defend:

• Treat every model output as a request, never an order. Only the policy engine can approve.
• Never let received tokens, NFTs or messages grant rights. Rights change only through an admin action.
• Keep outside text marked as untrusted and apart from the agent’s rules.
• Keep secrets, seed phrases and API keys out of the model’s context.
• Send new payees and unusual amounts to a human.

Kill Switches and Monitoring

A kill switch must work in seconds, and it must not depend on the agent agreeing to stop. Build three levels:

1. Pause: switch the agent’s policy to deny all. Every signing request fails at once.
2. Revoke: cancel the session key or on-chain grant, so even a leaked key is useless.
3. Sweep: move the float back to a treasury the agent cannot reach.

Then watch for the signs that come before a loss: spend speed jumping, new recipients, a rise in rejected requests, and repeated calls to the same seller. Log every request, rule decision, signature and payment with timestamps and the model version. Run a kill switch drill before launch, and again each quarter.

Build or Buy an Agent Wallet?

Most teams start on a provider and move to their own stack when volume, chains or rules outgrow it.

Option	What you get	Good for	Watch out for
Provider API (Coinbase, Circle, Privy, Turnkey)	Keys, signing and basic policies in days	Testing agents and early products	Per-signature fees, their rules, their chains
White label agent wallet	Your brand on a tested wallet core, with your policy engine	Fintechs offering agents to users	Check who owns the keys, logs and code
Custom build	Your own signer, policy engine, chains and audit trail	Platforms at scale or under licence	Longer build; you own audits and upkeep

Vendor bills grow with signatures. An agent that pays per API call signs a lot. At 100,000 signatures a month, here is what published plans cost (checked 16 October 2026):

• Privy: pay-as-you-go above 50,000 signatures has a $2,000 base fee plus $0.01 per extra signature, so about $2,500.
• Turnkey: $0.10 per signature on pay-as-you-go, so about $10,000. Its $99 Pro plan drops that to $0.05.

Enterprise contracts go lower, but the pattern holds. Signature fees grow with every agent you add.

Build cost. Published 2026 agency cost guides put a white label crypto wallet at $15,000 to $90,000 and a custom wallet at $50,000 to $200,000. An agent wallet sits in that range, with extra work on the policy engine, simulation, monitoring and the kill switch. Coinsclone quotes 3 to 5 weeks for a white label wallet and 8 to 12 weeks for a custom build.

Rules That Apply When You Hold Keys for Others

If the agent spends your own company’s money, the main duties are sanctions checks and good records. Holding keys for customers’ agents is different.

United States: FinCEN’s 2019 guidance treats hosted wallet providers as money transmitters. A provider that only supplies software, where users keep sole control of keys, generally is not. So the custody model you pick changes your licence needs.

European Union: under MiCA, custody and administration of crypto-assets for clients is a licensed service. A firm that holds agent wallet keys for EU users needs CASP authorisation, plus Travel Rule data on transfers.

Who is liable? An agent is not a legal person. Your terms must say who carries the loss when an agent pays the wrong party: the user, you or the model vendor. Write it down before launch, not after the first incident.

How to Launch an Agent Wallet: Step by Step

1. Define the job. List what the agent pays for, how often, on which chains, and the most it should ever spend in a day.
2. Pick the custody model. Use the decision tree above. Many teams pair a TEE server wallet for small payments with an MPC treasury for large ones.
3. Write the policy. Default deny, per-payment and daily caps, allowlists, rate limits, typed-data rules and human approval levels.
4. Wire up payments. Add x402 for paid APIs, and test on Base Sepolia or Solana Devnet first.
5. Red-team it. Feed the agent poisoned pages, fake 402 replies and hostile NFTs. Confirm the policy blocks each one.
6. Launch small. Fund a float of a few hundred dollars, turn on alerts and run the kill switch drill.
7. Raise limits slowly. Grow caps only after weeks of clean logs.

How to Choose a Partner and What to Prepare

Ask any team you talk to four things. Show the policy engine rejecting a request with the model switched off. Explain how typed-data signatures are handled. Show the kill switch working in under a minute. Say who owns the keys, logs and code after launch.

Before a scoping call, prepare: the agent’s jobs and chains, your expected payments per day, your daily risk budget, who should approve large payments, whether you hold keys for customers, and your licence status.

Coinsclone has been building wallets and payment software since 2018, with 350+ platforms delivered for 200+ clients across 20 industries. Our crypto wallet app development team builds MPC wallets with a rules engine for spending caps, safe address lists and multi-person sign-off. If you also want to charge agents for your own API or service, a stablecoin payment gateway handles the receiving side.

Frequently Asked Questions

Can AI agents have crypto wallets?

Yes. An AI agent can use a crypto wallet through a signer that holds the key for it. The agent asks for a payment, and a policy engine checks it against your limits before signing. Coinbase, MetaMask, Circle and others released agent wallet tools in 2026.

What is the Coinbase AI agent wallet?

Coinbase Agentic Wallets launched in February 2026. They let agents hold USDC, send, trade and pay for x402 services while the keys stay on Coinbase’s infrastructure. Users can cap spending per session and per payment, and every transfer is screened against OFAC lists.

Does MetaMask have an AI agent wallet?

Yes. MetaMask Agent Wallet opened early access on 8 June 2026. It is self-custodial, with server wallet keys held in a secure enclave. Guard Mode adds a rolling 24-hour outflow limit, 2FA for payments over the limit, and threat scans before signing.

Does Stripe have an AI agent wallet?

Stripe owns Privy, which gives each agent its own wallet with spending rules checked before signing. Stripe and Tempo also launched the Machine Payments Protocol in March 2026. AWS Bedrock AgentCore Payments lets developers pick a Privy or Coinbase wallet for agents.

What is the AI agent payment protocol x402?

x402 is an open standard that lets a server charge per request using the HTTP 402 “Payment Required” code. The agent’s wallet signs a payment, often in USDC, and resends the request. A facilitator then verifies and settles it on-chain.

How do you stop an AI agent from draining its wallet?

Keep only a small float in the agent’s wallet, and set a per-payment cap and a rolling 24-hour cap. Add allowlists, rate limits and human approval for large or new payments. Most important, enforce the limits in a policy engine or smart contract, not in the prompt.

Is it safe to give an AI agent a crypto wallet?

It is safe enough for small amounts if the agent never sees the key and hard limits sit outside the model. The main risks are prompt injection and loose policies that allow signed messages. Start with a few hundred dollars and raise limits only after clean logs.

How much does it cost to build an AI agent crypto wallet?

Published 2026 agency cost guides put a white label wallet at $15,000 to $90,000 and a custom wallet at $50,000 to $200,000. Agent features such as a policy engine, simulation and monitoring add to that. If you buy from a provider instead, budget for per-signature fees as volume grows.

Free Trial