{"id":11164,"date":"2026-07-27T09:49:07","date_gmt":"2026-07-27T09:49:07","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=11164"},"modified":"2026-07-27T09:49:07","modified_gmt":"2026-07-27T09:49:07","slug":"31-newly-discovered-vulnerabilities-expose-99-of-x402-crypto-payments-to-asset-theft-and-free-shopping","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=11164","title":{"rendered":"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping"},"content":{"rendered":"

<\/p>\n

\n

A new security study reported 31 previously unknown vulnerabilities across 15 major facilitators supporting x402, an HTTP-native standard for programmatic payments. The tested group represented 99% of observed transactions in the study window, and each facilitator failed at least one of eight rules for payment verification or settlement.<\/p>\n

The full findings mapped 49 violation instances to four attack classes: free shopping, asset theft, service denial, and gas abuse.<\/p>\n

\n
\"Coinbase\"Coinbase<\/div>\n
Related Reading<\/span><\/p>\n

Coinbase reveals x402 protocol to enable on-chain payments via HTTP<\/h3>\n

The project allows real-world use cases such as per-play gaming models, per-inference AI services, and per-article paywalls for publishers.<\/p>\n

May 6, 2025<\/span> \u00b7<\/span> Gino Matos<\/span><\/p>\n<\/div><\/div>\n

Facilitators are the shared middle layer. They check a client’s signed payment proof, construct and broadcast settlement, and often sponsor network fees; merchants use the response to decide when to release a protected service. More than 93% of server addresses in the study were associated exclusively with one facilitator.<\/p>\n

The findings do not show that every x402 payment was vulnerable, that each facilitator was exploitable in every way, or that Coinbase was breached.<\/p>\n

\n
\"What\"What<\/div>\n
Related Reading<\/span><\/p>\n

What is x402? The HTTP-402 payments standard powering AI agents, explained<\/h3>\n

Coinbase\u2019s open protocol just hit V2. Here\u2019s how x402 moves USDC over plain HTTP, what \u201cfacilitators\u201d do, and why Solana\/Base are leaning in.<\/p>\n

Dec 18, 2025<\/span> \u00b7<\/span> Gino Matos<\/span><\/p>\n<\/div><\/div>\n

What the four attack classes proved<\/h2>\n

In a free-shopping attack, the merchant opens the door before one clean, unique payment has settled. Asset theft gives an attacker a route to facilitator-controlled value. Service denial jams the payment lane with failing or resource-hungry settlements, and gas abuse leaves the facilitator paying the attacker\u2019s execution bill.<\/p>\n

Researchers validated two free-shopping cases end to end. They classified 10 more as high risk because actual loss depended on a merchant releasing service after verification without waiting for settlement or rolling back a failure.<\/p>\n

The paper also reports three gas-abuse instances and one ERC-6492 asset-theft path. A controlled proof of concept induced a token approval, but the team made no subsequent transfer and stole no funds.<\/p>\n

\n
\"Tiny\"Tiny<\/div>\n
Related Reading<\/span><\/p>\n

Tiny x402 payments expose the approval gap holding AI agents back<\/h3>\n

Artemis data shows crypto-native agentic payments are settling into millions of tiny x402 transactions, exactly the kind of automation the sector was built for.<\/p>\n

May 27, 2026<\/span> \u00b7<\/span> Gino Matos<\/span><\/p>\n<\/div><\/div>\n

\"Infographic\"Infographic<\/p>\n

\n
\n
CryptoSlate Daily Brief<\/span><\/p>\n

Daily signals, zero noise.<\/h3>\n

Market-moving headlines and context delivered every morning in one tight read.<\/p>\n

5-minute digest<\/span> 100k+ readers<\/span><\/p>\n<\/div>\n

\n

Free. No spam. Unsubscribe any time.<\/p>\n

Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n

You\u2019re subscribed. Welcome aboard.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

All 15 facilitators showed high-risk service-denial or cost-amplification paths, but the researchers ran no gas-drain experiment or availability-degrading load test and demonstrated no outage. Their separate address-based analysis covered more than 119 million Base and Solana transactions and estimated about $202,000 in gas and fees from Oct. 1 to Dec. 26, 2025, including about $5,800 associated with reverts.<\/p>\n

The researchers disclosed findings to 14 of 15 affected parties in January. As of Feb. 6, Coinbase, PayAI and Mogami had collectively acknowledged six vulnerabilities and fixed some issues while others remained in progress. Because results are anonymized, the paper does not identify which specific fix belonged to each vendor.<\/p>\n

CryptoSlate has previously explained x402’s facilitator model, covered its authorization constraints, and announced an x402 integration through Proofivy.<\/p>\n

Before merchants rely on x402 at greater scale, the authors recommend binding verification to settlement, reserving nonces, rechecking time and account state, strictly allowlisting ERC-1271 and ERC-6492 transaction shapes, capping sponsored fees, and rejecting uneconomic or non-settleable payments.<\/p>\n

Merchants should release service only after settlement succeeds or implement explicit rollback. An open protocol still needs hard controls around the intermediary that decides what counts as paid and safe to execute.<\/p>\n<\/div>\n

AI,Exchanges,Featured,Payments,Technology,Coinbase,Solana,stablecoins,USDC,x402Coinbase,Solana,stablecoins,USDC,x402#newly #discovered #vulnerabilities #expose #x402 #crypto #payments #asset #theft #free #shopping1785145747<\/p>\n","protected":false},"excerpt":{"rendered":"

A new security study reported 31 previously unknown vulnerabilities across 15 major facilitators supporting x402, an HTTP-native standard for programmatic payments. The tested group represented 99% of observed transactions in the study window, and each facilitator failed at least one of eight rules for payment verification or settlement. The full findings mapped 49 violation instances<\/p>\n","protected":false},"author":1,"featured_media":11165,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[309,84,62,5730,379,2111,5729,167,5732,152,282,1223,1582,5731,2859],"class_list":["post-11164","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-asset","tag-coinbase","tag-crypto","tag-discovered","tag-expose","tag-free","tag-newly","tag-payments","tag-shopping","tag-solana","tag-stablecoins","tag-theft","tag-usdc","tag-vulnerabilities","tag-x402"],"yoast_head":"\n31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"A study found 31 x402 vulnerabilities across facilitators covering 99% of observed transactions, risking theft, free shopping and gas abuse.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=11164\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping\" \/>\n<meta property=\"og:description\" content=\"A study found 31 x402 vulnerabilities across facilitators covering 99% of observed transactions, risking theft, free shopping and gas abuse.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=11164\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-27T09:49:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/x402-broken-payment-pipeline-fee-risk.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11164\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=11164\",\"name\":\"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11164#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11164#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/x402-broken-payment-pipeline-fee-risk.jpg\",\"datePublished\":\"2026-07-27T09:49:07+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"A study found 31 x402 vulnerabilities across facilitators covering 99% of observed transactions, risking theft, free shopping and gas abuse.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11164#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=11164\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11164#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/x402-broken-payment-pipeline-fee-risk.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/x402-broken-payment-pipeline-fee-risk.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11164#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping - Crypto News: Latest Cryptocurrency News and Analysis","description":"A study found 31 x402 vulnerabilities across facilitators covering 99% of observed transactions, risking theft, free shopping and gas abuse.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=11164","og_locale":"en_US","og_type":"article","og_title":"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping","og_description":"A study found 31 x402 vulnerabilities across facilitators covering 99% of observed transactions, risking theft, free shopping and gas abuse.","og_url":"https:\/\/cryptonews.uk.com\/?p=11164","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-07-27T09:49:07+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/x402-broken-payment-pipeline-fee-risk.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=11164","url":"https:\/\/cryptonews.uk.com\/?p=11164","name":"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=11164#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=11164#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/x402-broken-payment-pipeline-fee-risk.jpg","datePublished":"2026-07-27T09:49:07+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"A study found 31 x402 vulnerabilities across facilitators covering 99% of observed transactions, risking theft, free shopping and gas abuse.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=11164#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=11164"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=11164#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/x402-broken-payment-pipeline-fee-risk.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/x402-broken-payment-pipeline-fee-risk.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=11164#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11164"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11164\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/11165"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}