{"id":435220,"date":"2026-07-27T15:11:29","date_gmt":"2026-07-27T09:41:29","guid":{"rendered":"https:\/\/dripp.zone\/news\/31-newly-discovered-vulnerabilities-expose-99-of-x402-crypto-payments-to-asset-theft-and-free-shopping-crypto-news\/"},"modified":"2026-07-27T15:15:52","modified_gmt":"2026-07-27T09:45:52","slug":"31-newly-discovered-vulnerabilities-expose-99-of-x402-crypto-payments-to-asset-theft-and-free-shopping-crypto-news","status":"publish","type":"post","link":"https:\/\/dripp.zone\/news\/31-newly-discovered-vulnerabilities-expose-99-of-x402-crypto-payments-to-asset-theft-and-free-shopping-crypto-news\/","title":{"rendered":"31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping &#8211; Crypto News"},"content":{"rendered":"<p><\/p>\n<div>\n<p>A new security study reported 31 previously unknown vulnerabilities across 15 major facilitators supporting x402, an HTTP-native standard for programmatic payments. The tested group represented 99% of observed transactions in the study window, and each facilitator failed at least one of eight rules for payment verification or settlement.<\/p>\n<p>The <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/arxiv.org\/html\/2607.19545\">full findings<\/a> mapped 49 violation instances to four attack classes: free shopping, asset theft, service denial, and gas abuse.<\/p>\n<div class=\"cs-article-embed\"> <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cryptoslate.com\/coinbase-reveals-x402-protocol-to-enable-on-chain-payments-via-http\/\" class=\"cs-article-embed__link\"><\/p>\n<div class=\"cs-article-embed__media\"> <noscript><\/noscript><img class=\"lazyload\" width=\"1024\" height=\"538\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2024\/10\/cross-border-payment-1024x538.jpg\" alt=\"Coinbase reveals x402 protocol to enable on-chain payments via HTTP\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<div class=\"cs-article-embed__body\"> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Coinbase reveals x402 protocol to enable on-chain payments via HTTP<\/h3>\n<p>The project allows real-world use cases such as per-play gaming models, per-inference AI services, and per-article paywalls for publishers.<\/p>\n<p> <span class=\"cs-article-embed__meta-item\">May 6, 2025<\/span> <span class=\"cs-article-embed__meta-divider\">\u00b7<\/span> <span class=\"cs-article-embed__meta-item\">Gino Matos<\/span><\/p>\n<\/div>\n<p> <\/a><\/div>\n<p>Facilitators are the shared middle layer. They check a client&#8217;s signed payment proof, construct and broadcast settlement, and often sponsor network fees; merchants use the response to decide when to release a protected service. More than 93% of server addresses in the study were associated exclusively with one facilitator.<\/p>\n<p>The <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/arxiv.org\/abs\/2607.19545\">findings<\/a> do not show that every <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cryptoslate.com\/what-is-x402-the-http-402-payments-standard-powering-ai-agents-explained\/\">x402 payment<\/a> was vulnerable, that each facilitator was exploitable in every way, or that Coinbase was breached.<\/p>\n<div class=\"cs-article-embed\"> <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cryptoslate.com\/what-is-x402-the-http-402-payments-standard-powering-ai-agents-explained\/\" class=\"cs-article-embed__link\"><\/p>\n<div class=\"cs-article-embed__media\"> <noscript><img width=\"1024\" height=\"538\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/coinbase-x402-1024x538.jpg\" alt=\"What is x402? The HTTP-402 payments standard powering AI agents, explained\" loading=\"lazy\" decoding=\"async\"\/><\/noscript><img class=\"lazyload\" width=\"1024\" height=\"538\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/coinbase-x402-1024x538.jpg\" alt=\"What is x402? The HTTP-402 payments standard powering AI agents, explained\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<div class=\"cs-article-embed__body\"> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">What is x402? The HTTP-402 payments standard powering AI agents, explained<\/h3>\n<p>Coinbase\u2019s open protocol just hit V2. Here\u2019s how x402 moves USDC over plain HTTP, what \u201cfacilitators\u201d do, and why Solana\/Base are leaning in.<\/p>\n<p> <span class=\"cs-article-embed__meta-item\">Dec 18, 2025<\/span> <span class=\"cs-article-embed__meta-divider\">\u00b7<\/span> <span class=\"cs-article-embed__meta-item\">Gino Matos<\/span><\/p>\n<\/div>\n<p> <\/a><\/div>\n<h2>What the four attack classes proved<\/h2>\n<p>In a free-shopping attack, the merchant opens the door before one clean, unique payment has settled. Asset theft gives an attacker a route to facilitator-controlled value. Service denial jams the payment lane with failing or resource-hungry settlements, and gas abuse leaves the facilitator paying the attacker\u2019s execution bill.<\/p>\n<p>Researchers validated two free-shopping cases end to end. They classified 10 more as high risk because actual loss depended on a merchant releasing service after verification without waiting for settlement or rolling back a failure.<\/p>\n<p>The paper also reports three gas-abuse instances and one ERC-6492 asset-theft path. A controlled proof of concept induced a token approval, but the team made no subsequent transfer and stole no funds.<\/p>\n<div class=\"cs-article-embed\"> <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cryptoslate.com\/tiny-x402-payments-expose-gap-holding-ai-agents-back\/\" class=\"cs-article-embed__link\"><\/p>\n<div class=\"cs-article-embed__media\"> <noscript><img width=\"1024\" height=\"576\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/agents-payment-1024x576.jpg\" alt=\"Tiny x402 payments expose the approval gap holding AI agents back\" loading=\"lazy\" decoding=\"async\"\/><\/noscript><img class=\"lazyload\" width=\"1024\" height=\"576\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/05\/agents-payment-1024x576.jpg\" alt=\"Tiny x402 payments expose the approval gap holding AI agents back\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<div class=\"cs-article-embed__body\"> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Tiny x402 payments expose the approval gap holding AI agents back<\/h3>\n<p>Artemis data shows crypto-native agentic payments are settling into millions of tiny x402 transactions, exactly the kind of automation the sector was built for.<\/p>\n<p> <span class=\"cs-article-embed__meta-item\">May 27, 2026<\/span> <span class=\"cs-article-embed__meta-divider\">\u00b7<\/span> <span class=\"cs-article-embed__meta-item\">Gino Matos<\/span><\/p>\n<\/div>\n<p> <\/a><\/div>\n<p> <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX.png\" target=\"_blank\" rel=\"noopener\"><noscript><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-550047\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX.png\" alt=\"Infographic mapping the x402 facilitator payment flow, four attack classes, study evidence limits, measured transaction costs and recommended controls\" width=\"720\" height=\"1392\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX.png 902w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX-155x300.png 155w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX-530x1024.png 530w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX-768x1485.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX-794x1536.png 794w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\"\/><\/noscript><img loading=\"lazy\" decoding=\"async\" class=\"lazyload aligncenter wp-image-550047\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX.png\" alt=\"Infographic mapping the x402 facilitator payment flow, four attack classes, study evidence limits, measured transaction costs and recommended controls\" width=\"720\" height=\"1392\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX.png 902w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX-155x300.png 155w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX-530x1024.png 530w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX-768x1485.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/07\/ig_YtzV3wfSWLudU3NpUQClQUGX-794x1536.png 794w\" data-sizes=\"(max-width: 720px) 100vw, 720px\"\/><\/a><\/p>\n<div id=\"cs-inline-newsletter-6a67256c173d8\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\">CryptoSlate Daily Brief<\/span><\/p>\n<h3 class=\"cs-inline-newsletter__title\">Daily signals, zero noise.<\/h3>\n<p class=\"cs-inline-newsletter__copy\">Market-moving headlines and context delivered every morning in one tight read.<\/p>\n<p> <span><i class=\"fa-regular fa-bolt\" aria-hidden=\"true\"\/> 5-minute digest<\/span> <span><i class=\"fa-regular fa-star\" aria-hidden=\"true\"\/> 100k+ readers<\/span><\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p class=\"cs-inline-newsletter__privacy\">Free. No spam. Unsubscribe any time.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<p> <i class=\"fa-regular fa-circle-check\" aria-hidden=\"true\"\/> <span>You\u2019re subscribed. Welcome aboard.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<p>All 15 facilitators showed high-risk service-denial or cost-amplification paths, but the researchers ran no gas-drain experiment or availability-degrading load test and demonstrated no outage. Their separate address-based analysis covered more than 119 million Base and Solana transactions and estimated about $202,000 in gas and fees from Oct. 1 to Dec. 26, 2025, including about $5,800 associated with reverts.<\/p>\n<p>The researchers disclosed findings to 14 of 15 affected parties in January. As of Feb. 6, Coinbase, PayAI and Mogami had collectively acknowledged six vulnerabilities and fixed some issues while others remained in progress. Because results are anonymized, the paper does not identify which specific fix belonged to each vendor.<\/p>\n<p>CryptoSlate has <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cryptoslate.com\/what-is-x402-the-http-402-payments-standard-powering-ai-agents-explained\/\">previously explained x402&#8217;s facilitator model<\/a>, covered its <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cryptoslate.com\/tiny-x402-payments-expose-gap-holding-ai-agents-back\/\">authorization constraints<\/a>, and announced an <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cryptoslate.com\/updates\/cryptoslate-integrates-the-x402-standard-with-proofivy\/\">x402 integration through Proofivy<\/a>.<\/p>\n<p>Before merchants rely on x402 at greater scale, the authors recommend binding verification to settlement, reserving nonces, rechecking time and account state, strictly allowlisting ERC-1271 and ERC-6492 transaction shapes, capping sponsored fees, and rejecting uneconomic or non-settleable payments.<\/p>\n<p>Merchants should release service only after settlement succeeds or implement explicit rollback. An open protocol still needs hard controls around the intermediary that decides what counts as paid and safe to execute.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A new security study reported 31 previously unknown vulnerabilities across 15 major facilitators supporting x402, an HTTP-native standard for programmatic payments. The tested group represented 99% of observed transactions in the study window, and each facilitator failed at least one of eight rules for payment verification or settlement. The full findings mapped 49 violation instances [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":435221,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[230,225,221,227,226,228,229,60,223,224,222],"class_list":["post-435220","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency","tag-brave","tag-coinbase","tag-crypto","tag-decentralised","tag-decentralized","tag-decentralized-exchange","tag-erc-20","tag-featured","tag-meme-coin","tag-robinhood","tag-solana"],"_links":{"self":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/435220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/comments?post=435220"}],"version-history":[{"count":1,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/435220\/revisions"}],"predecessor-version":[{"id":435222,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/435220\/revisions\/435222"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/media\/435221"}],"wp:attachment":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/media?parent=435220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/categories?post=435220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/tags?post=435220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}