Who Is This Agent? On-Chain Identity and Trust in 2026

A Machine Shows Up With a Wallet

On a Base block last May, an autonomous trading agent read a reply on X, decoded a string of Morse code hidden inside it, and did exactly what the hidden instructions told it to do. Minutes later roughly $150,000 to $200,000 in tokens had left a wallet the agent controlled, moved by a transaction no human had approved. The setup, a Grok model wired to the Bankr trading agent, performed precisely as designed: read, interpret, act. It simply could not tell the difference between its owner and a stranger who had learned how to talk to it, an incident the OECD AI Incidents monitor logged on 4 May 2026.

That failure is the uncomfortable backdrop to a question crypto spent the back half of 2026 trying to answer. When an autonomous agent shows up on-chain with a wallet and starts transacting, who is it, what is it allowed to do, and can you trust its track record? A blockchain address proves that someone holds a private key. It says nothing about whether the thing behind that key is a seasoned market-maker that has settled ten thousand trades or a three-day-old script wearing a borrowed name.

This is the identity layer of the agent economy, and this year it went from pitch deck to deployed code. Ethereum shipped a standard for it, a venture-backed startup shipped a product for it, and academic researchers measured, in unforgiving detail, how little of it works so far. What follows walks through all three: the ERC-8004 registries now live on mainnet, the commercial Agent Passport that Kite launched, and the stubborn gap between a verifiable name and an actual reason to trust.

The money riding on the answer is not trivial. Tokens tagged as AI agents are worth about $3.56 billion combined, according to CoinGecko, a reminder that the stakes are real even while the plumbing is young.

Pay, Prove, Identify: The Three Layers of the Agent Stack

An autonomous on-chain agent is not a trading bot with a fresh coat of branding. A bot runs fixed rules a human wrote in advance. An agent pairs a large language model, the part that plans and interprets open-ended goals, with its own wallet and a toolbox it can call, and it decides for itself which transaction to sign next. That autonomy is the entire point, and the root of almost every hard problem around it.

Three separate layers of infrastructure have grown up to make these agents usable, and each matured at a different pace through the year.

The payments layer answers how an agent moves value. Standards such as Coinbase’s x402, which revives the long-dormant HTTP 402 Payment Required status code so an agent can settle a stablecoin payment in the middle of a request, and Google’s AP2 handle machine-to-machine settlement. More than 100 million x402 transactions have hit Base, per Chainalysis, though genuine agent-driven volume is a thin slice of that total.

The verification layer answers whether an agent’s computation was honest. Zero-knowledge machine-learning proofs and trusted-execution hardware let an agent show it ran the model it claimed, on the inputs it claimed, something we examined when we asked who actually mines the proofs.

The identity layer answers who the agent is and whether its history earns your trust. It stayed largely theoretical until this year. It is also where ERC-8004, reputation registries, and Agent Passports now compete, and where the rest of this piece lives.

Why a Key Is Not an Identity

The identity layer took longest because the problem is genuinely strange. For a human, identity services anchor to something off-chain: a passport, a face, a phone number, a credit file. An agent has none of that. It was spun up by a deployer, it may be one of ten thousand identical copies running the same open-source framework, and it can be cloned, retired, or handed to a new owner in a single transaction.

A wallet address does authenticate: whoever signs with the matching private key controls the account. But authentication is not identification. The address does not tell you the agent’s purpose, the human or company responsible for it, the spending limits it operates under, or whether its last hundred interactions ended well. Two agents with spotless-looking addresses can be a battle-tested arbitrage service and a freshly minted drainer, and on-chain they look identical right up until one of them robs you.

The honest answer to who is this is rarely a single name. It is usually a chain of delegation: a human principal, who deployed an agent, which spun up a session key, which signed the transaction. Identity for agents has to capture that chain, not a label. The industry’s response borrows an old idea, decentralized identifiers that resolve to a document describing what the thing is and how to interact with it, and wires those identifiers into on-chain registries that also carry reputation and validation. The aim is to make trust composable, not just identity. That is the bet behind ERC-8004.

ERC-8004: A Standard for Trustless Agents

ERC-8004, titled Trustless Agents, is the Ethereum proposal that turned the identity layer from a slide into deployed contracts. It was created on 13 August 2025 and still sits at Draft status on the Ethereum Improvement Proposal registry. Its authors read like a roster of the agent-payments push: Marco De Rossi of MetaMask, Davide Crapis of the Ethereum Foundation, Jordan Ellis of Google, and Erik Reppel of Coinbase.

The abstract states the goal plainly. The protocol proposes to use blockchains “to discover, choose, and interact with agents across organizational boundaries without pre-existing trust, thus enabling open-ended agent economies.” The phrase that matters is “without pre-existing trust.” Two agents run by companies that have never met, on opposite sides of the world, should be able to size each other up and transact. That is the promise permissionless blockchains already made for value; ERC-8004 extends it to reputation.

Technically it leans on existing standards, requiring EIP-155, EIP-712, EIP-721, and EIP-1271, and it is designed to complement rather than replace Google’s Agent2Agent (A2A) protocol, which handles how agents authenticate and advertise their skills. ERC-8004 adds the part A2A leaves out: a way to discover and trust an agent you have no prior relationship with. The reference registries went live on Ethereum mainnet on 29 January 2026, the starting block for the academic dataset discussed below, and community deployments have since spread the contracts across dozens of networks.

Davide Crapis, who leads AI work at the Ethereum Foundation, framed the stakes in commercial terms. “Commerce can’t happen if people don’t trust each other,” he told an interviewer for Crypto Briefing; “if they can’t trust each other then there’s not gonna be any commerce.” ERC-8004’s answer is three on-chain registries.

The Identity Registry: A Passport You Can Sell

The identity registry is the foundation, and it is the easiest piece to grasp because it reuses the most familiar primitive in crypto: the NFT. Each agent gets an ERC-721 token whose metadata, through the URIStorage extension, points to a registration file. That file is where the substance lives: the agent’s service endpoints, the protocols it speaks such as MCP and A2A, its declared capabilities, and links to whatever off-chain identity its operator chooses to attach.

Because the identifier is an NFT, agents become browsable and transferable through tooling that already exists. You can look one up the way you look up a profile-picture collection, and you can move it between wallets. That portability is a feature, not an accident; an agent’s identity should not be trapped on one chain or locked inside one app.

It also introduces a subtle trap. If identity is a transferable token, the entity standing behind a given agent can change without the identifier changing at all. A reputable agent builds up a glowing record, its passport is sold, and the buyer inherits the reputation while answering to nobody who earned it. The same mechanism that makes the identifier portable makes it detachable from the responsible party. Designers know this, which is why the registration file, not the raw token, is meant to carry the accountability, and why reputation and validation sit alongside identity rather than beneath it.

For now, the identity registry is the part that works. Registering an agent is cheap and well documented, which is exactly why, as the research further down shows, the chains are full of agents that have registered and then done nothing else.

The Reputation Registry: Portable, and Easy to Fake

If identity says this agent exists, reputation is supposed to say this agent is any good. The ERC-8004 reputation registry is a standard interface for clients to post feedback about an agent after dealing with it, with scoring done on-chain where composability matters and off-chain where more sophisticated aggregation helps. In principle it is the piece that lets an agent you have never used win your business on the strength of its history.

In practice it is the weakest link, for a reason anyone who has read online reviews will recognize: feedback is only as trustworthy as the people giving it. Nothing about signing a five-star review on-chain makes it honest. An operator can spin up a swarm of throwaway agents, have them rate each other, and manufacture a reputation for pennies in gas. The feedback is cryptographically signed, permanently recorded, and completely worthless.

This is the Sybil problem, and it is not hypothetical. A study titled Can Trustless Agents Be Trusted?, updated in mid-October 2026, examined ERC-8004 feedback across Ethereum, BNB Smart Chain, and Base through 13 May 2026 and found coordinated Sybil behavior behind 73.5 percent, 59.2 percent, and 90.6 percent of reviewers on the three chains respectively. Strip out the suspected Sybil feedback and, on Base, 86.8 percent of rated agents are left with no valid feedback at all. The researchers’ verdict is blunt: the registry as deployed “cannot function as a trust signal: values are not commensurable, feedback records are rarely grounded in verifiable interactions, and reputation can be manipulated at minimal cost.”

That is not a flaw in the idea of portable reputation. It is a warning that a reputation system without a fix for fake identities measures popularity among bots, not trustworthiness.

The Validation Registry: Integrity Is Not Legitimacy

The third registry is the most ambitious and the least deployed. Validation answers a different question than reputation: not whether other people liked this agent, but whether this specific piece of work was actually done correctly. ERC-8004 leaves the mechanism open and names three families: stake-secured re-execution, where independent validators redo the work and forfeit a bond if they lie; zero-knowledge machine-learning proofs; and trusted-execution-environment oracles.

Each maps to infrastructure crypto has been building for other reasons. Stake-secured re-execution is the logic behind restaking and shared security, a market whose rise and cooling we traced in our look at how restaking actually works. zkML proving is the cryptographic route, where the cost sits with whoever generates the proof. TEE oracles lean on hardware guarantees instead.

The crucial caveat is one the verifiable-compute crowd repeats like a mantra: a validity proof proves integrity, not legitimacy. It can show an agent ran exactly the model it claimed, on exactly the inputs it claimed, and wrote exactly the output on-chain. It cannot show that the model was a good one, that the inputs were not themselves poisoned, or that the outcome served your interests rather than the operator’s. A perfectly validated transaction can still be a perfectly executed theft.

That is why validation is a layer and not a verdict, and it is why, in the data, it is almost entirely aspirational so far. The high-assurance validation registry is the part of ERC-8004 that is least live, which means the strongest trust guarantee the standard offers is also the one you can least rely on today.

Kite’s Agent Passport: Identity as a Product

Standards move slowly; products do not. While ERC-8004 worked through the EIP process, a venture-funded startup called Kite shipped a commercial take on the same problem. Kite launched its EVM Layer 1 and an Agent Passport on 30 April 2026, according to its launch announcement, and billed the chain as the first crypto Layer 1 to plug into Google’s AP2 payments protocol.

The Passport’s design centers on the delegation chain that a bare key cannot express. Kite uses a three-tier identity derived through BIP-32 hierarchical keys: a user identity (the human or organization at the root), an agent identity (a verifiable on-chain identifier for the software itself), and a session identity (ephemeral keys scoped to a single task or time window). The human sets spending limits and a list of who the agent may pay; the agent operates inside them; each session gets throwaway keys so a compromise stays contained. It is the same insight behind session keys in account abstraction, applied to identity: never hand an autonomous process your root authority.

That structure attacks two of the failure modes above head-on. Scoped session keys limit the blast radius when an agent is prompt-injected, the way the Grok-and-Bankr agent was. And an explicit user-agent-session hierarchy records the chain of delegation, so the question of who is responsible stays answerable even when the signing key is ephemeral and short-lived.

Kite’s KITE token, which sits in the AI-agents sector at a market value near $292 million, per CoinGecko, is used for staking, governance, and paying for agent services. Whether a single-purpose chain is the right home for agent identity, or whether the open ERC-8004 registries win because they run anywhere, is one of the sector’s live arguments. Both sides are betting the same thing: that identity, not payments, is the real bottleneck.

The Reality Check: Registration-Heavy, Operationally Shallow

Strip away the roadmaps and look at what is actually on-chain, and the identity layer resembles less a working economy than an empty subdivision: the streets are paved, and almost no houses are built.

The most careful measurement comes from a June 2026 study, From Agent Identity to Agent Economy, which analyzed the first 10,000 agents registered under ERC-8004 on Ethereum, covering blocks mined between 29 January and 9 April 2026. The numbers are stark.

• Of 10,000 registered agents, just 67 (0.67 percent) exposed a working service endpoint.
• Only 628 (6.28 percent) received any reputation feedback at all.
• A mere 19 (0.19 percent) combined metadata, services, feedback, and cross-chain registration into anything resembling a fully operational agent.
• All 10,000 agents were owned by just 394 wallets; the top ten of them held 51.40 percent, for a Gini coefficient of 0.863.
• The single largest reviewer account produced 65.82 percent of all the feedback that existed.

Read those together and a picture forms. The activity is thin, the ownership is extraordinarily concentrated, and the handful of feedback records trace back mostly to one voice. The authors’ one-line summary has become the sector’s unofficial epitaph for the year: early ERC-8004 adoption is “registration-heavy but operationally shallow.”

None of this means the standard failed. Standards launch empty; that is normal, and the reference contracts have been live for less than a year. But it should end the talk of an agent economy that already runs itself on-chain. What exists today is scaffolding, a land grab for identifiers carried out mostly by a small number of operators registering agents in bulk, ahead of any real demand to use them.

Fixing Trust: Stakes, Personhood, and Curation

How do you build a reputation system that bots cannot capture? The proposals on the table in 2026 fall into a few camps, none of them solved.

The first is to make feedback expensive to fake by attaching a cost to the reviewer. Require a reviewer to stake capital that is slashed if its feedback is shown to be dishonest, or to have transacted real value with the agent before it can rate it, and the economics of a Sybil swarm get much worse. This is the same stake-weighting logic that secures re-execution validation, aimed at reviews instead of computation.

The second is to borrow proof-of-personhood for the humans behind the agents. If every reviewer has to prove it is backed by a distinct human, a thousand sock-puppets collapse into one vote. The catch is the one we covered in explaining why proof of human is not KYC: personhood proofs are privacy-fraught, contested, and themselves gameable, and most agent interactions are machine-to-machine, where no human sits in the loop to prove anything.

The third, and the one most likely to win in the near term, is to give up on fully permissionless reputation and lean on curation. Auditors, insurance pools, and allowlist operators aggregate the raw on-chain signals off-chain, apply their own Sybil filtering, and stake their own name on a verdict. ERC-8004 explicitly anticipates this by allowing off-chain scoring. It trades some decentralization for a trust anchor that has something to lose, which, for anyone about to let an agent spend real money, is often the trade they want.

The uncomfortable implication is that the fully trustless agent economy the standard is named for may route, at least at first, through some very old-fashioned trusted intermediaries.

Identity Does Not Equal Safety

Suppose all of this works. Suppose an agent has a verifiable identity, a Sybil-filtered reputation, and validated work behind it. It can still be dangerous, because identity and safety are different properties and solving the first does nothing for the second.

The Grok-and-Bankr drain that opened this piece is the canonical example. The agent was not impersonated; it was the real agent, carrying whatever identity it carried, doing real work. The attacker simply spoke to it in a way that made it act against its owner, hiding instructions in Morse code inside a reply and, in related versions of the attack, using a gifted NFT to unlock transfer permissions. Roughly $150,000 to $200,000 in DRB tokens moved on Base from a wallet the agent legitimately controlled. No identity registry would have stopped it, because the problem was not who the agent was; it was that a large language model still cannot reliably separate instructions from data.

That limitation is structural, not a bug awaiting a patch. Vitalik Buterin, writing about how to secure systems built on language models, argued the defenses have to be architectural rather than behavioral: “All LLM inference local first. All files hosted locally. Sandbox everything.” In the same analysis he cited a finding that should cool anyone’s enthusiasm for plug-and-play agent skills: roughly 15 percent of the skills examined contained malicious instructions. An agent that pulls tools from an open marketplace is drawing from a population where about one in seven is trying to hurt it.

The lesson for the identity layer is one of scope. A verifiable passport tells you which agent you are dealing with and what its record looks like. It does not make that agent competent, honest, or hard to hijack. Identity is necessary for trust and nowhere near sufficient, which is why the serious designs pair it with spending caps, session scoping, and human-in-the-loop approvals for anything large.

Where Identified Agents Already Act

For all the gaps, agents are transacting on-chain today, and the places they cluster hint at where identity will matter first.

Prediction markets are the clearest case. Autonomous agents now place a large share of the bets and, increasingly, judge the outcomes on platforms like Polymarket, a shift we documented in the story of how bots are setting the 2026 midterm odds. A market where machines both trade and adjudicate is one where knowing which machine, with what record, stops being academic.

DeFAI, the blend of DeFi and autonomous agents, is the other hotspot: agents manage vaults, rebalance liquidity, and chase yield across protocols. Exchanges have begun courting them directly, too. Coinbase expanded its for-Agents product in September to let agents buy thousands of tokenized equities and pull market data through x402 micropayments, extending the same listings machinery we described in tracing the path from Uniswap to Coinbase to non-human customers.

The tokens tracking this activity make a real, if volatile, market. The AI-agents category is worth about $3.56 billion, with roughly $391 million in daily volume, per CoinGecko. A snapshot of the leaders:

A warning the year taught repeatedly: a framework’s quality and its token’s price are different things. ElizaOS remains one of the most-used agent frameworks in open source, yet its token, once worth about $2.4 billion as ai16z, was declared “dead” by founder Shaw Walters in August. Buying the token is not buying the technology.

Who Is Liable When an Agent With a Passport Fails?

A verifiable identity for an agent raises a question lawyers, not engineers, have to answer: if the agent is identifiable, is it responsible? Everywhere that matters, the answer is no. An autonomous agent has no legal personhood, no tax identification, and nothing to sue. Liability flows to a human or a company, the deployer, the developer, the operator, or the user, depending on who controlled the failure. A passport makes the agent addressable; it does not make the software a defendant.

US regulators spent 2026 circling the issue without landing rules specific to agents. SEC Chair Paul Atkins has been the most explicit about where this is heading. “Artificial intelligence agents will increasingly participate in markets and financial decision-making at machine speed,” he said in May, “while blockchain rails allow those systems to move value instantly.” His stated philosophy, that the agency’s job is “to set the rules of play and referee the game, not to pick the winning team,” signals supervision over prohibition, but the detailed rulebook for machine-speed, agent-driven markets does not exist yet.

The Commodity Futures Trading Commission moved next. Its Innovation Task Force scheduled the first session of a new Frontier Forum series on artificial intelligence and agentic finance for 28 October 2026, putting staff face to face with the people building autonomous trading systems. As one report noted dryly, the agency is opening its first forum on agentic finance months after the industry had already written its own operational standards. Regulators are reacting to infrastructure that shipped first.

For readers outside the US, the contrast with Europe is instructive. MiCA regulates the service providers and token issuers around agents, not the autonomous software itself, and like the emerging US approach it grants agents no legal status of their own. Whichever jurisdiction you sit in, the identity layer changes the forensics (you can at least name the agent that acted) without touching the underlying rule that a person, somewhere, owns the consequences.

The Outlook: Identifiers Are Easy, Trust Is Hard

Step back and the shape of the year is clear. The industry built the identifiers first, because identifiers are the tractable part: a registry, an NFT, a registration file, a hierarchy of keys. ERC-8004 proves it can be done, and the reference contracts running on Ethereum mainnet since January prove it is done. The hard part, the part that was always going to be hard, is turning an identifier into a reason to trust.

The research this year says that part is barely started. A standard can be live, well authored, and genuinely useful, and still produce a registry that is 99 percent empty shells, dominated by a few bulk registrants, with a reputation layer that measures Sybil activity more than merit. That is not failure; it is the normal early state of an ambitious standard. But it should retire the claim that an agent economy already governs itself on-chain. What exists is scaffolding.

The next phase will turn on two things: whether anyone hardens the reputation and validation layers against the cheapest attack in crypto, the fake identity, and whether curation by parties with something to lose fills the gap while the trustless version matures. The CFTC’s October forum and the SEC’s next moves will shape the liability side in parallel. And the gap HOGE Wire has flagged all year, between rails that are built and agents that actually show up to use them, remains the number that matters.

An agent can now prove it is the same agent you dealt with yesterday. Whether you should have trusted it yesterday is still, mostly, your problem.

Frequently Asked Questions

What is ERC-8004?

ERC-8004, titled Trustless Agents, is a draft Ethereum standard created in August 2025 that gives autonomous AI agents an on-chain identity, a place to accumulate reputation, and a way to have their work independently validated. It defines three registries, for identity, reputation, and validation, and its reference contracts went live on Ethereum mainnet in January 2026. The goal is to let agents that have never met discover and transact with each other without pre-existing trust.

How does an AI agent prove its identity on-chain?

Under ERC-8004, each agent is issued an ERC-721 token whose metadata points to a registration file listing its endpoints, capabilities, and the protocols it speaks. Commercial systems such as Kite’s Agent Passport go further, using a three-tier hierarchy of user, agent, and session keys so the human principal, the agent, and each short-lived task are separately identifiable. In both cases a key proves control, while the registration file and the reputation record are what actually describe the agent.

Can you trust an AI agent’s on-chain reputation?

Not yet, in most cases. A 2026 study of ERC-8004 feedback found that the majority of reviewers on Ethereum, BNB Smart Chain, and Base showed coordinated Sybil behavior, and that removing the suspect feedback left most rated agents with no valid reputation at all. Until reputation systems make fake reviewers expensive, an on-chain score reflects popularity among bots more than genuine trustworthiness.

Who is legally responsible when an autonomous agent causes a loss?

A human or a company, not the agent. Autonomous agents have no legal personhood, so liability falls on whoever controlled the failure: the deployer, developer, operator, or user. US regulators including the SEC and the CFTC are examining agentic finance but have not written agent-specific rules, and an on-chain identity makes the acting agent easier to name without making the software itself a legal defendant.

What is the difference between agent identity and agent safety?

Identity tells you which agent you are dealing with and what its track record is. Safety is whether that agent can be trusted to act correctly and resist manipulation. They are separate: the Grok and Bankr agent drained in May 2026 was the genuine agent, not an impostor, and was compromised through a prompt-injection attack that no identity system would have prevented. Verifiable identity is necessary for trust but far from sufficient.

Marcus Okafor is a HOGE Wire senior editor covering AI agents, on-chain infrastructure, and crypto market structure.