ChatGPT can now issue your crypto. Blockaid predicts a wave of attacks

On Tuesday, MoonPay launched PayBox, the first payment vault built for AI agents. You ask Claude or ChatGPT to swap tokens, transfer funds between networks or make a simple purchase on Amazon, and the assistant prepares the transaction and gives it to you for signature. The product is based on the open x402 protocol and supports Solana and Ethereum-compatible networks, including Base, Arbitrum and Polygon. A day earlier, Blockaid published a report announcing a wave of attacks targeting exactly such solutions. Two events, one week, the same technology on both sides.

The agent prepares the transfer, the signature is yours

The design of PayBox separates transaction execution from storing funds. The wallet key is split by multi-party computation, a technique in which no single machine holds the entire key, and fragments lie in hardware-isolated enclaves. Neither the device, nor the session, nor MoonPay, nor the agent itself can sign a transaction alone.

Each passkey commit is valid for one specific operation and expires after use. Captured consent cannot be reproduced or extended to something larger. In addition, there are spending limits on your side and forced notifications, so you can set an amount above which the agent must ask.

This is a project made by someone who read reports about agent mishaps. And that’s good, because the reports are fresh.

In the same week, Blockaid counts its losses

Blockaid called the first half of 2026 the most hacked half-year in history. The company verified 212 incidents, which is 3.4 times more than in all of 2025, with losses exceeding USD 1 billion. Hackers linked to North Korea are responsible for nearly USD 600 million, including two of the four largest hacks of the six months. Ethereum projects lost USD 332 million, Solana projects lost USD 326 million.

The forecast at the end of the report is more important than the numbers themselves. Blockaid writes directly that the number of exploits related to artificial intelligence will increase, because the number of agent implementations increases approximately ten times a year. The first case he cites was the May wipeout of Bankr’s wallet, valued by the company at $216,000. Estimates from other sources are lower, starting at $150,000. The mechanism was painfully simple: the attacker asked Grok to translate a message written in Morse code, the model honestly translated the transfer order, and the payment bot treated this text as an authorized command.

Zscaler described two campaigns built exactly for this scenario. In the first one, the attacker positioned the website of a fake programming library and hid in its code a command for the visiting agent to pay for an access key. In the second, he forged a popular portfolio asset tracking panel and convinced agents that it was the original. Four models out of 26 tested made the payment, and two more simply believed in the fake. The attacker did not have to break any security. All he had to do was write to a machine that reads everything.

What this architecture doesn’t do

I think MoonPay solved the right problem, just not the one that hurts the most. Key splitting and one-time approvals prevent the wallet itself from being stolen. Command injection does not steal the key. It convinces you and your agent that the transfer is OK, and then waits for you to approve it.

This brings me back to something I repeat with every security announced with fanfare. Collateral is only worth as much as its enforcement mechanism. A spending limit works if you set it. The notification works if you read it instead of clicking it. The history of agents shows that the weakest link so far has not been the cryptographic piece of the puzzle, but the moment when someone stopped reading, and this is confirmed.

What does this mean for you

If you want to test this, treat such a wallet like cash in your pocket, not like a safe. You put in the amount you are willing to lose and set the limit right away, not “later.” The main resources stay where no assistant can reach.

The second thing is the source of risk. It doesn’t come from your agent or wallet provider, but from the sites that agent visits on your behalf. When you ask your assistant for something that requires going to an unknown website and then you are asked to approve a payment, it’s worth checking whether it’s what you wanted. The model will read everything it finds and, by default, treat it as work material.