Who paid the x402 doors?

Wash-adjusted x402 activity on Base, 2026-09-25 (UTC).

Published by Council of AI (CSOAI Ltd, registered in England and Wales, no. 16939677). Record as of 2026-09-26 15:22:43 UTC; signed with the board key and timestamped.

Measurement, not endorsement or accusation. This page names no seller, payer or index, and scores none. Every class below is a structural fact about addresses and amounts, such as “the payer is the payee”. None says why anyone paid. Where public chain data cannot answer a question, we say UNCHECKABLE and give no number.

Summary

We asked one question. Of the USDC payments on Base that reached a payee listed in the two public x402 Bazaars on 2026-09-25, how many came from distinct outside wallets? The rest came from the payee itself, a sibling payee of the same seller, another listed payee, or an amount below any price the payee lists.

The payees come from 1,757 addresses that 2,481 listed hosts name for USDC on Base. 453 of them received at least one settlement that day, and 439 received one from an outside wallet.

Read this with the next section. “Outside wallet” means only that the address is not linked to the payee in any way public data shows. Someone who pays themselves from a fresh address looks exactly like a customer. So the external share above is an upper bound on real outside demand. It is not an estimate of it.

Every settlement, by class

Each settlement gets the first class that fits, in this order.

Also excluded before classing: 358 inbound USDC transfers (42,500.95 USDC) to listed payees that did not come through EIP-3009 transferWithAuthorization. That is the path the x402 “exact” scheme uses for USDC, so these transfers are not counted as x402 settlements.

Repeat payers and concentration

Paying the same seller again is normal. A buyer who comes back is the best sign a service is useful. So repeat payers are flagged, not excluded. What the flags show is how much of the activity comes from a few wallet-and-payee pairs.

• Outside payers who paid exactly once that day: 446 of 1,047.
• The single largest outside payer sent 3.4% of the outside USDC. The ten largest sent 28.9%.
• Outside payers above a size floor. Our class rule has no fixed “test amount” cut-off. It compares each payment with the payee’s own smallest listed price. For readers who want a fixed floor, here are the counts: 828 paid at least 0.01 USDC in one settlement; 378 paid at least 0.10 USDC in one settlement; 29 paid at least 1.00 USDC in one settlement.

What we cannot see

Public chain data cannot answer these questions. Each one is UNCHECKABLE, and none is estimated:

• common control of payer and payee through different addresses (only same-address, same-listing and listed-payee links are observable).
• whether any service was delivered after payment.
• whether a person, an agent or a script initiated a payment.
• whether an EIP-3009 transfer answered an x402 challenge rather than another EIP-3009 flow.
• payments to payees that neither Bazaar lists.

Not measured in this record:

• every network other than Base mainnet (see population.accepts_entries_not_measured).
• facilitator identity (transaction sender) - not read.
• the x402 schemes other than exact (e.g. batch-settlement escrows).

Method

• Payees. We walked both public x402 Bazaar discovery indexes (Coinbase CDP and PayAI) to their stated totals: 24,556 listings read, CDP complete: true, PayAI complete: true. We kept every payment option with scheme “exact”, network Base mainnet and asset native USDC. Its payTo address is a listed payee, and the smallest amount any listing asks of that address is its smallest listed price.
• Window. Blocks 51,752,527 to 51,795,726 (43,200 blocks). These are the first and last Base blocks of 2026-09-25 UTC, checked at both boundaries.
• Unit. one USDC Transfer log to a listed payee, in a transaction that also carries a USDC AuthorizationUsed log whose authorizer is the transfer's sender (EIP-3009 transferWithAuthorization).
• Classes. First match wins, in the order of the table above. CSOAI’s own wallets are listed in the record and classed ESTATE_SELF, so our own test payments never count as outside demand.
• Headline rule. distinct_external_payers = distinct senders with >= 1 EXTERNAL settlement.
• Reads. Public RPC (https://mainnet.base.org, https://base.drpc.org), 122 calls, in chunks of 2,000 blocks. A chunk that errors is split, never skipped. The run fails closed if either Bazaar read is short.
• Schedule. The record is produced every day after the x402 conformance read, for the previous full UTC day. This page shows the signed record for 2026-09-25.

What others have measured

Their findings, not ours. The methods, networks and windows differ, so these figures cannot be combined with each other or with ours. We quote each source word for word, from the bytes we read (sha256 given).

Our own doors

CSOAI runs x402 doors too. Our own count of distinct outside payers, which excludes our own wallets and any settlement of zero, is served live at /api/revenue as one_number. It comes from our facilitator-confirmed settlement records, not from this chain read. We give the link rather than a copy, so the figure is never stale.

How to verify

• Record: x402-activity-2026-09-25.json. Signature: .signed.json. Timestamp: .json.ots (an OpenTimestamps calendar commitment until Bitcoin confirms it).
• Every settlement is one line in x402-activity-2026-09-25.rows.jsonl.gz (sha256 6a1771ef57a7d543cee8e19b47e987d0d4e0da908f77f58525217b1cc2e1d875). Every payee is one line in x402-activity-2026-09-25.payees.jsonl.gz (sha256 951d0026e14af408da138b8c4be65f4ec9212934a7a6a77e3fd27dcef168fba1). Both hashes are in the record, so the signature covers them.
• Check the signature. Canonicalise the payload in the .signed.json: JSON, keys sorted, no whitespace, UTF-8. Its sha256 must equal signature.payload_sha256, and payload.artifact.sha256 must equal the sha256 of the record file. Then verify sig_ed25519 with the Ed25519 key #board-attestation-1 in csoai.org/.well-known/did.json.
• Re-run it: the verify note in the record lists the steps. The code is the file named in method.code, with its sha256.
• Context sources: context.json (signed: context.signed.json).

Object, or ask for a re-check

If a class is wrong for a payment you made or received, or a figure here is wrong, email nicholas@csoai.org. You can also use the crawler page at /census, which explains what we read and how to object or opt out, or /dispute. Corrections are dated in our corrections ledger.