x402 Security Disclosures

Real threats caught in the x402 agent-payment economy, with on-chain proof · by PulseFeed · Changes · Observatory

23
high severity
16
medium
6
receiver hijacks
13
bait-and-switch
39
total active

Active incidents

🎣
kronossignals.com bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x36038e1d… price_bait_switch price_rising
8h ago
🎣
agenttax.io bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x6f4B383B… price_bait_switch
8h ago
🎣
agents.allium.so bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x510eb3a2… payto_rotating price_bait_switch payto_unverified_onchain
8h ago
💸
api.bitrefill.com price gouging
price is anomalously high ($1000/call) vs the ecosystem.
on-chain proof ↗ 0x480CD46E… price_absurd
8h ago
🎣
funding.lonestaroracle.xyz bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x52Ab5391… price_bait_switch
8h ago
🎣
headlessoracle.com bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x26D4Ffe9… price_bait_switch
1d ago
🎣
agents.dyoeway.org bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x834b189A… price_bait_switch
1d ago
💸
x721.dev price gouging
price is anomalously high ($40.2/call) vs the ecosystem.
on-chain proof ↗ 0x70DA5f2A… price_absurd
1d ago
💸
api.x721.dev price gouging
price is anomalously high ($40.2/call) vs the ecosystem.
on-chain proof ↗ 0x70DA5f2A… price_absurd
1d ago
💸
api.tantra-authority.com price gouging
price is anomalously high ($29.97/call) vs the ecosystem.
on-chain proof ↗ 0xa8c3cd00… price_absurd
2d ago
🎣
agentpay.tools bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0xE8B25A72… price_bait_switch
2d ago
🎣
api.strale.io bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x66D7C2F9… price_bait_switch
2d ago
🎣
mcp.gapup.io bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0xbA1E0A29… price_bait_switch
2d ago
🎣
api.hyperextend.xyz bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x548fC289… price_bait_switch
3d ago
🎣
orionkr.xyz bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0xd30fa341… price_bait_switch
3d ago
🎣
store.agentexchange.work bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0xc91cE629… price_bait_switch price_rising
3d ago
🎣
x402-agent-store.rileycraig14.workers.dev bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0xc91cE629… price_bait_switch price_rising
4d ago
🔀
api.neynar.com payto hijack
changed its payTo receiver 0xa6a8…01a1 → 0xbe3f…ba79 on an established baseline — re-verify before paying.
on-chain proof ↗ 0xbe3fc886…
7d ago
🔀
api.400860.xyz payto hijack
changed its payTo receiver 0x0150…f3e9 → 0x1f01…9a2f on an established baseline — re-verify before paying.
on-chain proof ↗ 0x1f013066… price_rising
10d ago
🔀
dnsdomain.hergertsynthora.com payto hijack
changed its payTo receiver 0x15d3…1cc8 → 0x1080…7de0 on an established baseline — re-verify before paying.
on-chain proof ↗ 0x10800a5a…
12d ago
🔀
defidata.hergertsynthora.com payto hijack
changed its payTo receiver 0x15d3…1cc8 → 0x1080…7de0 on an established baseline — re-verify before paying.
on-chain proof ↗ 0x10800a5a… price_rising
13d ago
🔀
three.ws payto hijack
changed its payTo receiver wwwwwDxFWRn7grgr3Esrsg5C6NvDoDHSA4gaCffccrU → 0x4022…f402 on an established baseline — re-verify before paying.
on-chain proof ↗ 0x4022de2d…
16d ago
🔀
engedi.digi-life17.workers.dev payto hijack
changed its payTo receiver 0xabc2…5a6d → 0x06b5…2189 on an established baseline — re-verify before paying.
on-chain proof ↗ 0x06b525eb…
22d ago
💸
crownblock.lonestaroracle.xyz price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x52Ab5391… price_high
8h ago
💸
api.anchor-x402.com price gouging
price is anomalously high ($1.77/call) vs the ecosystem.
on-chain proof ↗ 0x127462e2… price_high
8h ago
💸
x402.quicknode.com price gouging
price is anomalously high ($1/call) vs the ecosystem.
receiver not on Base — no on-chain link price_high
8h ago
💸
api.cryptoetfsentinel.com price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x169Bf49c… price_high
8h ago
💸
x402factory.ai price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x402B79eC… price_high
8h ago
❓
x402.browserbase.com unverified receiver
payTo 0xE700…EEEa has no on-chain USDC history — unconfirmed by real payments.
on-chain proof ↗ 0xE70035be… payto_rotating payto_unverified_onchain
1d ago
💸
api.myceliasignal.com price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0xD593832C… price_high
1d ago
💸
mcp.gapup.io price gouging
price is anomalously high ($1.5/call) vs the ecosystem.
on-chain proof ↗ 0xbA1E0A29… price_high
1d ago
💸
emc2ai.io price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0xc9368b30… price_high
1d ago
💸
boofy.fun price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x2E3AB1B1… price_high
1d ago
💸
agi.apify.com price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x4aAbE17C… price_high
1d ago
💸
api.postagent.sh price gouging
price is anomalously high ($1.24/call) vs the ecosystem.
on-chain proof ↗ 0x4ecc58bb… price_high
1d ago
💸
tiresapi.com price gouging
price is anomalously high ($5/call) vs the ecosystem.
on-chain proof ↗ 0xF0d33a22… price_high
2d ago
💸
gpt55.558686.xyz price gouging
price is anomalously high ($1.11112/call) vs the ecosystem.
on-chain proof ↗ 0x1f013066… price_high
2d ago
❓
api.swedata.org unverified receiver
payTo 0x9eB7…3833 has no on-chain USDC history — unconfirmed by real payments.
on-chain proof ↗ 0x9eB79ebc… payto_unverified_onchain
3d ago
💸
cheaptokens.ai price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x213c8d74… price_high
3d ago
Why this matters — ~70% of x402 endpoints are dead or scams, and a safe endpoint can be hijacked or repriced overnight. Every incident above is derived from PulseFeed's continuous independent audit and, where the receiver is on Base, linked to on-chain proof you can verify yourself.

Verify before your agent pays: GET /trust?endpoint=<url> · Machine-readable: /incidents.json · Full dataset: PulseFeed Data API

Honesty note: categories are stated as facts from our data (e.g. "payTo has no on-chain USDC history", "advertised price ≠ amount actually charged"). We do not assert intent where it can't be proven; an "unverified receiver" or "possible hijack" is a risk signal, not a conviction. By-design receiver rotation is excluded. Window: 30 days · 39 active incidents · generated 2026-07-29T11:13:07.414Z.
Observatory · Changes · Methodology · Data API