The press release reads like a promise. The codebase is silent. Fireblocks, the institutional custody behemoth that processes over $4 trillion in digital asset transfers annually, has joined the Agentic Payments Alliance. The alliance's stated goal: to build the infrastructure for AI agents to execute payments autonomously. But after sixteen years of dissecting blockchain protocols, auditing smart contracts, and watching infrastructure providers pivot into narratives, I have learned one thing: the absence of technical disclosure is not a sign of maturity—it is a warning.
Code does not lie, but it does hide.
I have spent the last decade embedded in the cryptographic trenches. I reverse-engineered Zcash’s Sapling upgrade in 2018, tracing Groth16 proof verification through assembly code to find a gas optimization that the core team missed. I watched my own flash loan arbitrage bot get drained by a reentrancy exploit in 2020, losing $40,000 from a test wallet because I trusted the yield before the logic. I published a hostile code review of an NFT marketplace’s royalty distribution contract in 2021, delaying their launch by two weeks but earning the respect of a community that values truth over revenue. I analyzed Celestia’s data availability sampling mechanism during the 2022 bear market, producing a 50-page technical deep dive when everyone else was chasing memecoins. And in 2025, I designed a zk-SNARK-based identity verification protocol for a traditional bank’s tokenization pilot, bridging the gap between institutional compliance and decentralized privacy.
These experiences have forged a specific lens: I see infrastructure not as a product, but as a set of attack surfaces. When Fireblocks announces a pivot toward AI agent payments, I do not see a partnership. I see a new class of vulnerabilities waiting to be exploited.
This article is not a summary of the press release. It is a forensic dissection of what the announcement does not say, what the alliance has not built, and why the intersection of autonomous agents and institutional custody is a minefield disguised as a growth opportunity.
Hook: The Silence of the Code
On March 18, 2026, Fireblocks issued a statement confirming its membership in the Agentic Payments Alliance. The alliance, formed by a consortium of fintech and blockchain companies, aims to create a standardized framework for AI agents to initiate and settle payments using digital assets. The press release quoted Fireblocks’ VP of Product: “We are proud to contribute our institutional-grade infrastructure to enable the next wave of commerce—autonomous agent economies.”
Sounds compelling. Sounds inevitable. But where is the technical specification?
I searched for the alliance’s whitepaper. I searched for a GitHub repository. I searched for a testnet, a proof-of-concept, or even a blog post explaining the cryptographic primitives. I found nothing. The announcement is a single layer of narrative: a logo on a website, a quote in a press release, and a promise of future integration.
This is not a product launch. This is a positioning move. Fireblocks is a private company valued at $8 billion, servicing institutions like BNY Mellon, ANZ Bank, and PayPal. It does not have a token. It does not need to pump a price. But it does need to signal relevance in the AI narrative, which has been sucking liquidity out of crypto since 2024. The Agentic Payments Alliance gives Fireblocks a seat at the table without requiring any technical commitment.
But the market does not care about commitment. The market cares about narrative. The moment this news broke, I saw Twitter threads labeling it “bullish for AI agents” and “Fireblocks positioning for the next cycle.” Analysts started drawing lines between the alliance and potential token launches. None of this is based on code. It is based on hope.
The best audit is the one you never see.
I have written that line in dozens of reports. It means that the most secure system is the one that never needs an audit because its design is so robust that vulnerabilities are impossible. But the reverse is also true: the most dangerous infrastructure is the one that never gets audited because its design is hidden behind NDAs and press releases.
The Agentic Payments Alliance is, at this moment, a black box. And when it comes to autonomous agents moving money, a black box is a liability.
Context: The Infrastructure Before the Agents
To understand the technical challenge, you must first understand Fireblocks’ existing infrastructure. Fireblocks provides a suite of digital asset custody and payment solutions based on Multi-Party Computation (MPC) and a Hardware Security Module (HSM) backbone. Its core product is a wallet-as-a-service platform that allows institutions to store, transfer, and manage digital assets with policy-based controls.
Key components of Fireblocks’ stack:
- MPC Key Generation and Signing: Each private key is split into multiple shares, distributed across different servers, and never reconstructed in a single location. Threshold signatures (e.g., ECDSA, EdDSA) are generated without ever exposing the full key.
- Policy Engine: Administrators define rules for transaction approval—whitelist addresses, spending limits, role-based access, time delays, and multi-signature requirements. The policy engine sits between the user and the signing process, enforcing compliance before any transaction is broadcast.
- Tokenization and Asset Management: Fireblocks supports over 30 blockchains, thousands of tokens, and integrates with DeFi protocols through its “DeFi API” for institutional staking, lending, and trading.
This infrastructure is battle-tested. Fireblocks has never suffered a security breach due to a flaw in its MPC implementation. The vulnerabilities in its ecosystem have come from third-party integrations and user error—never from the core signing mechanism.
Now, the Agentic Payments Alliance wants to extend this infrastructure to AI agents. The premise is simple: an AI agent—trading bot, supply chain optimizer, personal assistant—needs to make payments autonomously. It cannot call a human every time it wants to execute a transaction. It needs a wallet that can sign transactions based on a set of pre-defined rules, without human intervention.
But here is the critical distinction: an AI agent is not a human. It cannot undergo KYC. It cannot be held legally liable. It cannot be asked to “confirm” a transaction via a pop-up. It is a piece of software that, if exploited, can drain a wallet faster than any human could react.
The front-runners are already inside the block.
In the world of MEV, front-runners exploit the order of transactions. In the world of AI agents, front-runners will exploit the intent of the agent. An agent that is programmed to “buy the cheapest ETH” can be manipulated by a malicious actor who creates a fake liquidity pool with a front-run trap. The agent does not know it is being exploited. The code does not care.
The alliance’s challenge is to build a layer that authenticates the agent’s intent without requiring human oversight. This is not a trivial problem. It is a cryptographic and economic problem that, if solved incorrectly, could lead to catastrophic losses.
Core: The Technical Anatomy of an Agentic Wallet
Let me propose a hypothetical architecture for how Fireblocks might extend its infrastructure to support AI agents. This is not based on any disclosed design—because none exists—but on my own experience building automated trading systems and auditing institutional custody solutions.
Assume we have an AI agent that needs to execute transactions on-chain. The agent has a wallet—a set of addresses controlled by Fireblocks’ MPC key generation. The agent does not have access to the private key shares. Instead, it communicates with the Fireblocks API, which triggers the policy engine.
Under the current system, the policy engine requires a human to approve transactions via a mobile app or web interface. For an agent, we need a programmatic approval mechanism. This could be done through:
- Pre-approved whitelist: The agent can only send transactions to a set of pre-approved addresses (e.g., a specific DEX router, a specific lending protocol). This is simple but rigid. Agents need flexibility to discover new opportunities.
- Spending limits with time windows: The agent can spend up to X amount per day, but any transaction above a threshold triggers a human review. This is a common pattern in corporate credit cards, but for agents, the threshold can be exploited by splitting transactions.
- Intent verification via zero-knowledge proofs: The agent generates a proof that the transaction it wants to execute satisfies a set of constraints (e.g., “I am swapping token A for token B, and the expected output is within 1% of the market price”). The policy engine verifies the proof without seeing the agent’s internal logic. This is the most secure but also the most complex.
Fireblocks already has a policy engine that supports role-based access and multi-signature. Extending it to support a “machine role” is straightforward. The hard part is defining the constraints that prevent exploitation.
Consider the following attack vector: A malicious agent is trained to make “optimal” trades, but the training data is poisoned. The agent learns to send funds to a wallet controlled by the attacker, disguised as a legitimate DEX. The agent’s intent verification proof would be “I am swapping USDC for ETH at the best rate,” but the actual destination address is a honeypot. The proof could be valid if the constraints only check the price, not the counterparty.
This is not a theoretical problem. In 2023, a trading bot called “MEV-Share” was exploited when a searcher submitted a bundle that matched the bot’s intent but front-ran the trade. The bot lost 100 ETH. The intent was correct; the execution was malicious.
Reentrancy is not a bug; it is a feature of greed.
I wrote that line after the 2020 flash loan exploit that drained my test wallet. The attacker used a reentrancy vulnerability in a poorly audited lending pool to call the withdraw function multiple times before the balance was updated. The same principle applies to agentic wallets: if the agent can be tricked into signing multiple transactions based on the same state, the result is a drain.
To prevent this, the policy engine must enforce a nonce-based ordering and ensure that each transaction is idempotent. But agents are designed to be adaptive. They may need to retry a failed transaction with a different parameter. The policy engine must distinguish between a legitimate retry and a replay attack.
This is where the lack of open-source code becomes dangerous. Without a public specification, we cannot audit the logic. We cannot verify that the policy engine handles edge cases correctly. We cannot test for race conditions between the agent’s decision loop and the blockchain’s mempool.
Based on my audit experience, I have identified three critical security requirements for any agentic payment system:
- Intent binding: The agent’s intent must be cryptographically committed before the transaction is signed. The signature must be over the intent, not just the raw transaction data. This prevents the agent from being tricked into signing a different transaction that matches the same hash.
- Rate limiting with state awareness: The agent cannot execute more than N transactions per block, and each transaction must reference the previous one to prevent out-of-order execution. This is similar to the Bitcoin protocol’s sequence number, but for agents.
- Fallback to human: If the policy engine detects anomalous behavior—e.g., a transaction to a never-before-seen address, or a sudden spike in transaction frequency—it must escalate to a human operator. The agent can be paused, and the operator can inspect the logs.
These requirements are not novel. They are standard in institutional trading systems. But the challenge is implementing them in a decentralized, trust-minimized environment where the agent is not a trusted party.
The Agentic Payments Alliance has not disclosed any of these details. The press release mentions “building a framework for trustless agent payments,” but trustlessness is a spectrum. Without code, we cannot assess where on that spectrum this alliance falls.
Contrarian: The Blind Spot of Standardization
The conventional wisdom is that the Agentic Payments Alliance is a positive development—it brings together industry players to create standards, reducing fragmentation and enabling interoperability. I disagree. The conventional wisdom misses the fundamental risk: standardization of insecure protocols amplifies the damage when a vulnerability is discovered.
Consider the history of smart contract standards. The ERC-20 standard enabled the explosion of tokens, but it also created a uniform attack surface. Every reentrancy bug in a DeFi protocol exploited the same pattern: a call to an external contract before state updates. The OWASP Top 10 for smart contracts is essentially a list of ways ERC-20 and ERC-721 standards can be abused.
Now imagine a standard for agentic payment authorization. If every participant in the alliance adopts the same intent verification protocol, a single vulnerability in that protocol can be exploited across all their systems. The alliance becomes a single point of failure.
Fireblocks, in particular, is a honeypot. It holds billions in custody. If its agentic payment extension has a bug, the attacker does not just drain one wallet—they drain the entire pool of agent wallets managed by Fireblocks. The insurance fund, if one exists, would be insufficient.
I have seen this pattern before. In 2021, I audited a cross-chain bridge that used a multi-signature scheme with a standard set of signers. The bridge was hacked because the signers all used the same security model. When one signer was compromised, the entire bridge fell. Standardization without diversity is brittle.
The alliance should focus on diversity of implementation, not uniformity of interface. Each member should implement the agent authorization layer in a different way, using different cryptographic primitives, so that a failure in one does not propagate to others. But that is harder to sell to investors. Investors want a single narrative, not a fragmented one.
The best audit is the one you never see.
This line cuts both ways. If the alliance’s standard is never audited because it is proprietary, we will never know if it is secure. And if it is audited but the audit is kept private, we cannot verify the auditor’s claims. I have seen this happen with dozens of projects: a private audit, a clean report, and then a hack three months later because the audit missed a subtle interaction.
Furthermore, the alliance’s focus on “AI agents” assumes that the agents are the ones initiating payments. But the real threat is not the agent—it is the environment. Agents live in a hostile environment filled with adversaries who can manipulate the data the agent relies on. If the agent gets its price feed from a compromised oracle, it will sign a transaction that is economically destructive. The alliance’s framework must address oracle manipulation, but no mention of it has been made.
In my 2022 modular blockchain research, I analyzed how data availability layers can be attacked by withholding blocks. The same principle applies here: if an agent is dependent on off-chain data (e.g., market prices, transaction status), an attacker can manipulate that data to cause the agent to sign a malicious transaction. The policy engine cannot detect this because it does not have access to the off-chain data.
This is the blind spot. The alliance is building a payment layer, but it is not building a trust layer. The agent must trust the data it receives. Without cryptographic guarantees on the data source, the entire system is vulnerable to oracle attacks.
Takeaway: The Vulnerability Forecast
I do not doubt that Fireblocks will eventually launch a product for agentic payments. The company has the engineering talent, the institutional trust, and the incentive to expand its revenue streams. But the timeline is uncertain, and the security guarantees are absent.
My forecast: within the next 18 months, we will see the first major exploit of an agentic payment system. The attack will not be a novel cryptographic break. It will be a simple manipulation of the agent’s intent—a poisoned oracle, a front-run on the agent’s transaction, or a replay attack that the policy engine failed to detect.
The victim will be an institution using Fireblocks’ agentic wallet, and the loss will be in the millions. The community will blame the AI, but the fault will be in the infrastructure. The alliance will issue a patch, and the cycle will continue.
The front-runners are already inside the block.
In the agentic economy, the front-runners are not just other traders. They are the data feeds, the oracle networks, the meme pools, and the hidden assumptions in the code. The best defense is not a standard—it is a rigorous, open-source, formally verified protocol that has been tested against every known attack vector.
Until I see that protocol, I will treat every agentic payment announcement as a marketing exercise, not a technical breakthrough.