31 vulnerabilities expose 99% of x402 crypto payments to theft

A security study identified 31 vulnerabilities across 15 major facilitators of x402, an HTTP-native standard for programmatic payments, affecting 99% of transactions observed. Each facilitator failed at least one of eight payment verification or settlement rules. The vulnerabilities were categorized into four attack classes: free shopping, asset theft, service denial, and gas abuse. In free-shopping attacks, merchants prematurely release services before payment settlement. Asset theft allows attackers to access facilitator-controlled value, while service denial disrupts payment processing. Gas abuse results in facilitators covering attackers' costs. Researchers validated two free-shopping cases and identified 10 additional high-risk scenarios. They also reported three gas-abuse instances and one asset-theft path. All facilitators exhibited high-risk paths for service denial or cost amplification. The study analyzed over 119 million transactions and estimated approximately 202000 dollars in gas and fees from October 1 to December 26, 2025. Findings were disclosed to 14 of the 15 affected parties in January, with Coinbase, PayAI, and Mogami acknowledging six vulnerabilities by February 6. The authors recommend binding verification to settlement, reserving nonces, and implementing strict controls before wider adoption of x402 by merchants.

Disclaimer: This content is provided for general branding and informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online events, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets or to use any services. Crypto assets are highly volatile and may result in loss. WEEX services and online events may not be available in all regions and are subject to applicable laws, regulations, and eligibility requirements. You are responsible for ensuring that your use of WEEX services complies with local laws and for carefully assessing the risks before participating in any crypto-related activities.