Research

Banks Push Back on FDIC: Stablecoin Wallet Screening Should Fall to Issuers

As the FDIC moves to embed BSA and sanctions compliance into stablecoin issuer oversight, banks draw a clear line in comment letters: wallet screening and secondary-market monitoring belong to issuers, while reserve account banks answer only for their own customers.

Western Union Launches Stablecard: Turning Remittance Payouts Directly Into Stablecoin Spending

Western Union and Rain launch Stablecard, a payment card settled in USDPT that connects remittance payouts directly to stablecoin spending—marking the first time a traditional remittance giant uses stablecoin as a settlement asset at the payout end.

CoinDesk Policy Roundtable: CLARITY Act and Anchorage's Agentic Banking Build

Visa and Lianlian Complete First Real-Time B2B Agent Transaction: Agent Payments Enter Actual Settlement

Visa and Lianlian have completed the first real-time B2B Agent transaction through LoopXPay, marking the first time machine-initiated commercial payments settled with real funds — moving the industry from proof of concept to production.

Movement Recruits Industry Veterans to Bet on Emerging Markets, Agent Payment Settlement Infrastructure Accelerates

Movement announces hiring of senior experts in payments and stablecoins, accelerating stablecoin adoption in emerging markets like Africa and Southeast Asia, reflecting the underlying demand for efficient cross-border settlement in the AI Agent economy.

Ruflo MCP Vulnerability: Unauthenticated Attackers Can Execute Commands and Poison AI Memory

A critical flaw in the open-source Ruflo MCP implementation allows remote code execution and session-memory tampering, threatening AI agents used in payments and compliance.

Visa-Artemis Report: x402 Protocol Reaches $15M Annual Volume, AI Micropayment Infrastructure Accelerates

The protocol processed $15 million in transactions in its first year, as machine-to-machine payments scale up—but real-time compliance modules remain absent.

Attack Lab #6: Pinning the Audit Fingerprint into Bitcoin — Undeniable Even to Us and GitHub

Episode 5 admitted GitHub is still a company we hold an account with. This one pins the audit chain tip into Bitcoin via OpenTimestamps: free, no private key, no gas. To rewrite audit history undetected you'd have to rewrite our database, GitHub's records, and Bitcoin — the last of which no one can do. Honest limit: a timestamp proves existence and immutability, not correctness; the anchoring interval is the tamper window. Six episodes; we broke ourselves five times, all in public.

Attack Lab #4: We Could Quietly Erase Our Own Attack Records — the Audit Log Was Undefended

Last episode we poisoned the source of the audit chain; this one deletes the records themselves. Real result: a blocked attack can be wiped from both the threat log and the audit log in two clicks, no trace — our own delete buttons were the proof. Pillar 5 (traceability / non-repudiation) was hollow. We rebuilt the audit log as a hash chain: deleting or editing any entry breaks the chain and is caught on verification.

Attack Lab #3: Our Attribution Was Theater — Anyone Could Spend With Your Agent

The KYA gate checked whether an agent was attributed — never whether you are that agent. Real result: an attacker paid with the victim's agentId, zero credentials, 200 allow; and could overwrite the attributed entity, poisoning the audit chain. We added a seventh gate. Attribution without proof is theater.

Attack Lab #2: We Broke Our Own Firewall — A Thousand Small Payments

A per-transaction cap stops greed, not patience. We found our own reference implementation didn't satisfy our own standard (RAP Pillar 2), added a sixth gate, and caught an uglier float bug that killed legitimate payments. All real run data.