· four exchange APIs · rebuilt daily
AI agent crypto payments rely on session keys and scoped allowances
The finding
Autonomous AI agent crypto payments rely on restricted sub-accounts and ERC-4337 session keys to cap potential losses per execution.
These wallet architectures enforce spending allowances and call-data constraints at the smart contract level.
Transaction reversal, cross-chain session revocation, and legal liability for execution errors remain completely unstandardised.
How AI agent crypto payments execute today
Software agents executing programmatic payments cannot safely hold raw private keys in local memory or prompt contexts. Passing an unencrypted Externally Owned Account key to an agent exposes the entire wallet balance to prompt injection attacks, context leaks, and logic loops. Production deployments isolate funds using two main execution patterns: centralized exchange sub-account API keys with hard permissions, or smart contract account abstraction onchain.
Onchain execution relies on ERC-4337 account abstraction and smart contract wallets. The primary key owner delegates constrained transaction rights to a temporary session key stored in the agent runtime environment. This session key is validated by a smart contract validator module that checks parameters before signing off on execution.
An agent operating through a session key cannot transfer arbitrarily large amounts or call unspecified contracts. The validation contract checks four specific constraints before letting a transaction execute: destination contract address, method selector, maximum spend limit per call, and expiration timestamp.
Worth knowing
Storing an exchange API key or private key directly inside an agent prompt context allows malicious context injection to extract the raw key string in plain text.
Onchain standards and programmatic key delegation
Standardisation efforts focus on narrowing what an agent key can sign without human confirmation. EIP-7579 defines modular smart accounts that decouple key validation from wallet logic. This lets developers attach specific permission modules to an agent wallet without redeploying the contract core.
EIP-712 typed data signatures allow off-chain agents to build intent payloads that smart contracts verify onchain. The agent constructs an intent message, signs it with a scoped key, and passes it to an execution bundler.
| Architecture Type | Key Location | Permitted Scope | Risk Profile |
|---|---|---|---|
| Direct EOA | Agent Runtime | Unrestricted | Single error drains full balance |
| Exchange Sub-API | Centralized Server | Specific Endpoint / Pair | API key leak exposes sub-account funds |
| ERC-4337 Session Key | Encrypted Agent Memory | Target Address + Selector | Losses bounded by call limits and expiry |
When agents trade or settle positions on decentralized platforms, execution costs depend on protocol transaction fees and venue funding rates. Automated liquidity agents managing perpetual positions must account for these baseline operational costs when scheduling transactions.
Where this goes wrong
Revoking a session key requires an onchain transaction that costs gas. An agent loop executing invalid calls will continue spending gas until the revocation transaction confirms onchain.
Cost structures and venue execution for automated agents
Automated agents opening perpetual positions run directly into venue-specific fee structures and funding rate variations. These micro-costs accumulate quickly when an agent trades frequently or maintains balanced market-neutral inventory across exchanges.
The table below shows perpetual futures fee schedules for automated agent execution across major venues:
| Exchange | Futures Maker Fee | Futures Taker Fee |
|---|---|---|
| MEXC | 0.0000% | 0.0200% |
| Bitget | 0.0200% | 0.0300% |
| OKX | 0.0200% | 0.0500% |
| Bybit | 0.0200% | 0.0550% |
Holding long or short perp positions across platforms incurs funding payments settled every 8 hours. The current normalized 8-hour funding rates for selected assets demonstrate significant spreads between venues:
| Asset | Bybit 8h Rate | MEXC 8h Rate | OKX 8h Rate | Bitget 8h Rate | Spread |
|---|---|---|---|---|---|
| BTC | +0.0020% | +0.0035% | +0.0100% | +0.0100% | 0.0080% |
| ETH | -0.0121% | -0.0051% | -0.0030% | +0.0023% | 0.0144% |
| SOL | -0.0055% | +0.0100% | +0.0016% | +0.0055% | 0.0155% |
An agent holding a long ETH position of $100,000 on Bitget pays $2.30 in funding every 8 hours at +0.0023%. The same long position held on Bybit receives $12.10 every 8 hours due to the -0.0121% funding rate. Over a 30-day period, that difference equals $432.00 in total position maintenance cost. An automated agent programmed without real-time venue spread comparisons will consistently select suboptimal execution routes.
What to do instead
Restrict agent session keys to maker-only orders where possible to lower baseline exchange fee drag on automated strategies.
Unsolved failure modes: revocation, limits, and legal liability
Three structural problems remain open in autonomous key control: cross-chain revocation latency, dynamic slippage limits, and legal liability assignment.
Cross-chain revocation fails because state changes on one network do not invalidate session keys on another. If an agent is compromised on Arbitrum, the corresponding session key on Optimism remains fully valid until a separate revocation transaction settles on Optimism.
Dynamic slippage protection presents another operational hurdle. Smart contract session keys check static call parameters, but cannot assess whether a swap rate is economically rational at runtime. An agent lured into executing a swap against a manipulated decentralized oracle will satisfy the session key's contract target check while incurring severe economic loss.
Finally, legal liability for rogue execution is completely undefined. Blockchains treat a valid cryptographic signature as authoritative regardless of whether an underlying software loop hallucinated. When an agent drains its scoped allowance due to an unhandled API error, the protocol retains the funds and the loss rests entirely on the operator who funded the account.
How do AI agent crypto payments work without exposing private keys?
Agents use ERC-4337 account abstraction session keys or restricted sub-account API keys. These keys restrict transaction scope to approved smart contracts, transaction values, and expiration times.
What limits an AI agent from spending an entire crypto account balance?
Smart contract session key modules enforce hard spending allowances and method call targets. The agent cannot call unapproved contract selectors or exceed designated asset thresholds per transaction block.
How do funding rates affect automated trading agents holding crypto perps?
Perpetual funding rates adjust every 8 hours, creating cost variations across venues. For example, holding an ETH position on Bybit yields a -0.0121% 8-hour rate while Bitget charges +0.0023%, altering position maintenance costs significantly over time.
Who is responsible when an autonomous AI agent executes a bad transaction?
The operator who funded the wallet bears all losses. Blockchain networks treat valid cryptographic signatures as final, regardless of execution bugs or model hallucinations.