Who can freeze the money AI agents pay with?
An AI agent that pays for an API over x402 pays in a stablecoin, almost always USDC. Every such coin has an issuer that can freeze a holder, mint more, and on most chains replace the token's code. That is part of the deal with a regulated dollar, and no secret. What is less known is how many signatures each of those powers takes. The chain shows it, so we read it for every stablecoin the sellers in the Trust Index ask for.
What x402 sellers ask for
On 22 October 2026, 2,756 sellers had at least one endpoint that answered a valid, payable x402 offer. 2,554 of them (93%) take payment on Base, and 1,629 (59%) take nothing but USDC on Circle's EVM chains. To see which coin each network's sellers ask for, we fetched one offer from each of 791 sellers, up to 40 per network:
| Network | Sellers | What their offers ask for |
|---|---|---|
| Base | 2,554 | USDC (39 of 39 sampled; 2 also offer EURC) |
| Solana | 736 | USDC (40 of 40) |
| Polygon, Arbitrum, World Chain, Monad, HyperEVM, Avalanche, Optimism, Ethereum, Sei, Unichain, Sonic, Celo | 5 to 364 each | USDC (one Arbitrum seller asks for USD₮0) |
| Algorand | 192 | USDC (ASA 31566704) |
| XRP Ledger | 99 | RLUSD, usually next to XRP |
| X Layer | 90 | USD₮0 (36 of 39) |
| BNB Chain | 84 | USD1, World Liberty Financial's dollar (39 of 40) |
| Robinhood Chain | 35 | Paxos's Global Dollar (USDG) |
| Stellar | 9 | USDC |
Who holds each power
For each coin we read who can replace the code (upgrade), create new coins (mint), stop all transfers (pause), freeze single holders (blacklist or freeze), and appoint the others (owner). Then we looked at what kind of account each one is: a plain key, a multisig and how many signatures it needs, or a timelock and how long it waits.
| Coin and chains | Upgrade | Mint | Pause and freeze | Owner |
|---|---|---|---|---|
| USDC on Base, Polygon, Arbitrum, World Chain, Monad, HyperEVM, Avalanche, Optimism, Ethereum, Sei, Unichain, Sonic and Celo; EURC on Base | one key | a minter contract, owned by one key | one key each | one key |
| USDC on Solana | no contract code to replace | 2-of-4 multisig | freeze: 2-of-4 multisig | – |
| USDC on Algorand | no contract code to replace | reserve signs with a 2-of-4 multisig | freeze: 2-of-4 multisig; no clawback | manager: rekeyed (its own key was a 2-of-3 multisig) |
| USDC on Stellar | no contract code to replace | the issuer's own key is switched off; 4 signers, any 2 of them for everything, including freezing a holder; no clawback | ||
| RLUSD on the XRP Ledger | no contract code to replace | master key off, no regular key; a list of 26 signers: one of 8 heavy keys plus at least one other. Clawback is on | ||
| USD₮0 on X Layer and Arbitrum | through a contract owned by a 3-of-5 multisig | set by the owner | 3-of-5 multisig | |
| USD1 on BNB Chain | through a contract owned by a 3-of-5 multisig | set by the owner | a contract owned by a 3-of-6 multisig | |
On Base, these are five different keys: one can upgrade the contract, one can pause it, one can blacklist holders, one owns it, and one owns the contract that decides who may mint. Each can act alone. Paxos's Global Dollar we could not read on Robinhood Chain itself; on Ethereum, its owner is a timelock with a 24-hour delay.
One USDC, two ways of guarding it
The striking part is not that USDC can be frozen. It is that the same issuer guards the same coin differently per chain. On Solana, Algorand and Stellar, freezing a holder or minting takes two of four signers. On Base and twelve other EVM chains, one key can freeze a holder, one can pause every transfer, and one can replace the code that defines everyone's balance. On those chains, no second party has to agree, and there is no delay in which holders could react.
A single key on chain doesn't mean careless. Circle can keep each key in hardware security modules behind its own approval steps, and the chain can't show that. But an agent can't check it either. What it can check is the number of signatures, and on the chains where most x402 money moves, that number is one.
What this means
- For agents and the people who set them up: paying in USDC means trusting Circle. That's fine, but keep the agent's wallet to a working balance, as you would with any hot wallet. Of all the coins in this list, the issuer can freeze every one.
- For other tokens: the same check matters far more for a token nobody vouches for. If one key can upgrade a meme coin's contract, that key can change anyone's balance. From today, presign-guard's token verdict reads this on chain for EVM tokens: who can upgrade, mint, pause or blacklist, and whether that is one key, a multisig with its threshold, a timelock with its delay, or renounced. An upgrade one key can make alone is orange, unless the token is on the trust list or a well-known official contract such as USDC.
- For sellers: taking a second coin or chain costs little, and it gives a buyer whose USDC is frozen another way to pay. Today 59% of sellers take nothing but USDC on EVM chains.
How we measured
Sellers are the hosts with at least one endpoint that answered a valid, payable x402 offer in the Trust Index scan of 22 October 2026, with testnets left out. For the coins per network we fetched one endpoint per seller, up to 40 sellers per network, and read the asset of each offer: 791 sellers answered.
The controls were read on chain, read-only, on 22 October 2026:
- EVM: the EIP-1967 admin and beacon slots and the older ZeppelinOS admin slot (Circle's FiatToken proxy), the getters
owner,masterMinter,minter,pauser,blacklister,supplyControllerandassetProtectionRole. Each holder's type: no code means one key;getThresholdandgetOwnersmean a Safe;requiredandgetOwnersmean the older MultiSigWallet;getMinDelaymeans a timelock; other contracts were followed to theirowner(). - Solana: the mint's mint and freeze authorities, both SPL Token multisig accounts.
- Algorand: the asset's manager, reserve, freeze and clawback addresses, and the signature on their latest transactions.
- Stellar: the issuer's signers, weights and thresholds on Horizon.
- XRP Ledger: the issuer's flags and signer list.
What the chain can't show: who holds each key, how it is stored, and what approvals an issuer runs before it signs.
Questions
Can Circle freeze the USDC an AI agent holds?
Yes, on every chain, as with any regulated stablecoin. What differs is how many signatures it takes. On Base and the other EVM chains we read in October 2026, USDC's blacklist and pause roles each sit with a single key. On Solana, Algorand and Stellar, freezing USDC takes 2 of 4 signatures.
Who can upgrade USDC on Base?
The proxy admin of USDC's FiatToken proxy, which on 22 October 2026 was a plain account with no contract code: one key. The same holds for USDC on Polygon, Arbitrum, World Chain, Monad, HyperEVM, Avalanche, Optimism, Ethereum, Sei, Unichain, Sonic and Celo, and for EURC on Base. Upgrading replaces the code behind the token.
Is a single key unsafe?
Not by itself. An issuer like Circle can keep a key in hardware security modules behind its own approval process, and the chain can't show that. What the chain does show is that one signature is enough: no second party on chain has to agree, and there is no delay in which holders could react.
How can an agent check who controls a token?
presign-guard's token verdict (GET https://presign-guard.fizzl.eu/v1/token, $0.01 over x402) reads it on chain for EVM tokens since 22 October 2026: who can upgrade, mint, pause or blacklist, and whether that is one key, a multisig (with its threshold), a timelock (with its delay) or renounced. An upgrade one key can make alone is orange, except on trust-list and well-known official tokens such as USDC.