Explaining how compliance, trust, and verification become product infrastructure in web3.
Joined February 2026
- Tweets77
- Following16
- Followers5
- Likes0
Pinned Tweet
I'm Dan. I write about the checks that run before money moves onchain: who is paying, what they're allowed to do, and what the other side can prove later.
Wallets, exchanges, merchants, and now AI agents.
What I watch, and what I post here:
FCA's draft crypto guidance (CP26/38, Oct 23) lists as poor practice a "rigid rule concerning the number of 'hops'" a firm scrutinises.
Also poor: a vendor score the firm is "unable to explain or evidence".
If your tracing depth flexes with risk, what pushes it deeper?
V12 found 25 flaws in the x402 SDKs, 3 critical. One: the default client had no spend limit, so a hostile API could request an auto-signing agent's full token balance.
Fixed Aug 18: $1 default cap. No advisory. npm audit is silent on 2.22.0.
If you raised the cap, to what?
Mastercard opened Agent Pay for Machines to developers on Oct 20.
Agent signs a voucher within budget. Seller checks it, delivers, redeems them in batches. Mastercard: "Guarantee payment now. Settle later."
API sellers: what would you check on a voucher before delivering?
3/ Rules that land as product work.
ESMA's stablecoin wind-down, GENIUS rules, Travel Rule gaps, EBA supervision of USDC.
Each one ends up as a flag, a block or a log line someone has to build. I try to say which.
Proof and Circle's Money20/20 demo: an agent shows a verified ID credential over x401, pays USDC over x402, and the merchant keeps signed proof of who approved it, for disputes.
A USDC payment has no chargeback.
Merchants selling to agents: who would you show that proof to?
Mastercard's new Stablecoin Security API scores a payment before it goes onchain.
The BIS study it cites: nearly 60% of 2025 stablecoin transfer events on Ethereum sit inside multi-step transactions.
Monitoring teams: do you score the transfer or the whole transaction?
Chainalysis counts 138M+ x402 transactions on Base.
TRM screened x402 commerce and found 0.6% to 7.5% of the value looks agentic. A cron job and an agent leave the same onchain record.
If you sell a per-call API over x402, what in your logs tells you an agent is calling?
Comments on Treasury's proposed GENIUS rule on foreign stablecoins close today.
A US exchange could rely on a foreign issuer's promise to obey lawful orders only after reasonable due diligence.
Treasury asks if that should cover the token's seize, freeze and burn functions.
Amex's Intent Intelligence framework (Oct 13): the customer signs off on merchant and max budget before an AI agent pays.
That intent scopes the card credential used at checkout.
Amex's example: asked for white Nike size 9, the agent submits Adidas. Amex could block it.
FASB's stablecoin proposal: cash-equivalent status needs a direct redemption right with the issuer. Comments close Nov 19.
Coinbase books USDC as cash and has a Circle redemption deal. A firm with exchange-bought USDC may fall short.
Issuer onboarding moves into treasury.
ESMA's Oct 8 stablecoin opinion reaches custody and transfers. The Jan 2025 statement had left both open.
Legacy balances: cleared in 3 months. Warnings and client acknowledgments don't count.
Coinbase set Oct 30 for EEA USDT and PYUSD. Leftovers after that convert to USDC.
SlowMist's Fomo case started on Fomo's own token page: the "project website" link.
One fake captcha later, a bookmarklet had the user's Privy tokens. ~$48K gone.
A link a platform renders carries the platform's trust. That field needs the same review as a withdrawal address.
Ledger confirmed an unauthorized hardware implant in an affected user's device.
Separately, Mark Karpelès found an implant that leaves the secure element alone and still passes the genuine check.
That check covers one chip. The seed passes through everything else on the board.