The x402 economy runs on disposable addresses

Take every address that has ever received an x402 payment on Base, all 1.4 million of them, and sort them by how long they lived. The one in the middle lived for exactly one transaction. Not one day. One transaction: it received money once and was never seen again.

We expected to find merchants. We run an index of every x402 / EIP-3009 USDC transfer on Base (1,419,172 addresses and 166 million transfers at the time of writing), and when we first pulled the lifespan numbers we assumed the typical recipient would look like a service: an address printed into docs, embedded in configs, paid again and again. That population exists. It is not what the protocol is made of.

The median address exists for one transaction

Measure the lifespan of an address as the time between its first and last observed transfer. Across the whole index:

The median lifespan is zero. More than half of all addresses appear in exactly one transaction and are never seen again.

Three out of four are gone within a day.

Compare that with any economy you would call healthy. A payment address of a real service is long-lived by nature: people write it down, clients cache it, money keeps arriving at it. A population where the typical address is single-use does not look like a population of merchants. It looks like a population of tickets, printed, punched once, thrown away.

Nearly half of new addresses arrive in batches

Creating an address costs nothing, and the tooling that automates payments automates creation just as well. You can see this directly in the funding graph. We track where each address's first money came from, and when hundreds of new addresses share a single first funding source, that is the signature of batch creation. An address farm.

In one week of August 2026 (the weekly report series carries the running numbers), 14,888 addresses received their first funds. Of those, 6,708, or 45%, arrived in groups of ten or more siblings funded by the same source. There were 119 such groups that week. The largest held 1,375 addresses. Across every address our nightly scoring batch covers, one in four carries the shared-batch-funding pattern.

Here is what we cannot see: intent. A funding edge does not tell us why a thousand addresses were created, and we don't pretend it does. Some batch funding is mundane, exchanges sweeping, infrastructure rotating keys. But we have yet to find an honest business model that requires a thousand sibling payment addresses created inside a week, while every quota-farming, airdrop-farming and fake-volume scheme we know of requires exactly that.

Three quarters of scored addresses say "avoid", and that is not the scary part

Our scorer runs nightly over the active slice of the index, 187,567 addresses with enough recent relevance to score. The current verdict distribution:

Read that carefully, because the wrong reading is tempting. This does not mean three quarters of x402 recipients are scams. An avoid verdict means strong risk patterns are present, and in this population the dominant patterns are exactly the ones above: the address is days old, has almost no history, and was funded in a batch. 79% of scored addresses are young, 97% have thin history, 25% share batch funding.

The honest conclusion is structural, not criminal: the x402 address population is dominated by disposable infrastructure. Whether any given disposable address belongs to a fraud scheme, a bot farm, or a perfectly innocent script someone ran once, its history cannot vouch for it. In a payment protocol with no chargebacks, "cannot vouch" is a risk statement all by itself. That is the scary part.

Why the ecosystem is shaped like this

Three properties of x402 combine into this picture, and none of them is a flaw you can patch:

1. Addresses are free. Burning one after a single use costs nothing, so nothing selects for longevity.
2. Payments are final. EIP-3009 transfers have no dispute path, so a counterparty's past behavior is the only leverage a payer has. Disposable addresses have no past.
3. The payers are agents. Software doesn't get suspicious. It will pay a five-minute-old address with the same confidence as a five-year-old one, thousands of times, unattended.

Fraud economics respond to incentives, and the incentive here is plain. In an economy where the median payment is around $0.006, nobody disputes a bad purchase; nobody even notices one. The only defense that scales is not paying the wrong address in the first place.

What this does not tell you

It does not tell you that a young address is a scam. Every honest service was new once, and we score a brand-new address as neutral with low confidence, not as guilty. It does not tell you what happens after a payment: we see the money move, not whether the API answered. And it says nothing about the payers, only about the addresses that get paid. What it does tell you is the base rate, and the base rate is that the address your agent is about to pay has, more likely than not, no history at all.

What to do with this if you run agents

Treat an unknown x402 address as untrusted by default; statistically, that is simply the base rate. Before the first payment, run the checks we walk through in how to check an x402 counterparty before paying: age, returning counterparties, funding source, graph neighborhood. Or let your agent do it in one call: the API returns a score, a verdict and the reasons for $0.01 over x402 itself, and the free demo answers a few checks a day with the same JSON.

All numbers above come from the WalletBureau index of x402 / EIP-3009 USDC transfers on Base; the queries were run on 2026-08-20. The classification rules, including what counts as an x402 payment, are in the methodology. The weekly series in reports carries these numbers forward.