Why Fake Crypto Buyers Are About to Get Expensive
An AI agent can pay a seller in crypto without a checkout page. Circle's researchers now want the payment trail itself to tell the agent which sellers are worth paying.
Key Takeaways
- Anduin ranks sellers by shared payment history.
- Manipulation cost rose roughly 23-fold in tests.
- $8,259 fools 813 buyers; $291 fools one.
- Still experimental, and silent on service quality.
In a November 13 research post, Circle describes Anduin, an experimental ranking system that scores providers by who has already paid them, and by whether those payers overlap with the buyer’s own. The design goal is narrow and specific: force anyone trying to fake a provider’s popularity to spend money on businesses they do not own.
Fake customers cost almost nothing to make
A Sybil attack is one operator posing as many participants. In an agent marketplace that means spinning up buyer wallets and paying your own service from each of them, so a storefront that has never served a real customer looks busy. The transfers are real on-chain, but the money never leaves the operator’s hands; network fees are the only thing actually spent.
The accompanying research paper puts a figure on how cheap this is: pushing a fake provider’s reputation up to the marketplace median costs about $0.0027 under the usage-based metrics marketplaces rely on today. Reviews are not a fallback. Across the 66 million payments the researchers examined, fewer than 4,000 carried a voluntary on-chain rating.
Those payments move over the x402 standard, which lets a service return its price in an HTTP 402 response and lets software settle it inside the request, with no account or checkout step. That is what makes agent-to-service purchasing work, and also what makes a crowded storefront so easy to fabricate. Coindoo has looked separately at what an x402 payment does and does not reveal about who is behind it.
How Anduin turns payments into a price
The researchers model every buyer and provider as a node in a graph, with payments as the links between them, weighted by how much was paid, how often and how recently. A standard recommender, collaborative filtering, works on that graph by finding buyers who look like you and suggesting what they bought. It has no way to tell a cluster of real customers from a cluster of wallets funded by the seller; both look like demand.
Anduin reads the same graph differently. It starts from the providers a buyer already pays and treats those as the buyer’s trusted anchors. Say an agent regularly pays a translation service. Other buyers also pay that translator, and some of them pay a data provider the agent has never used. The data provider earns a recommendation through that path, and the strength of the recommendation is bounded by the real money flowing along it.
That bound is the whole point. Payments between wallets the attacker controls never touch one of the buyer’s trusted providers, so they contribute nothing to the path. To manufacture a connection, the attacker has to pay the translator, a business it does not own, and cannot get that money back. The paper formalises this with three flow-based scoring variants and proves a lower bound on attacker spending for each; the one Circle highlights is called Amplified Flow. The question that follows is how large that lower bound turns out to be on real data.
$8,259 to fool everyone, $291 to fool the buyer that matters
The researchers took a 90-day window of x402 payments ending June 21 and found 813 buyers who went on to pay a provider they had never used before. Each method was asked to rank providers for those buyers in advance; a hit meant the provider they actually chose next was ranked first. The attack test then asked how much an outsider would have to spend to put a new provider in first place instead. The full dataset behind the study runs to 66.1 million payments worth about $6.1 million across 16 networks, collected between March 23 and August 26.
Read across the first row and the trade-off is clear: Anduin gave up 0.4 percentage points of prediction accuracy and made the attack roughly 23 times more expensive. Read down the second column and the picture is less comfortable. Topping the ranking for every buyer at once costs thousands; topping it for a single high-value buyer costs a few hundred dollars. For a dishonest seller, the second number is the one that matters, because one well-chosen buyer is the realistic target.
Whether $291 deters anyone depends on what that buyer is worth to the attacker, and the paper does not estimate that side of the ledger. Its figures are the cost of moving a ranking. They say nothing about the revenue a fake provider could extract once it gets there, so the deterrent is a condition rather than a result: the scheme works where the reward stays below the price, and Circle’s data cannot yet show where that line falls.
Where the price stops holding
The lower bound rests on one assumption: money paid to a buyer’s existing providers is gone for good. Circle states that colluding providers, and providers that quietly refund the attacker, fall outside Anduin’s guarantee. If the translator in the example above is willing to take a cut and send the rest back, the attacker’s real cost collapses to the fee, and the ranking is no harder to buy than before. Anduin assumes the attacker controls none of the providers the buyer already uses; in an open market, that is a condition to verify, not a given.
The second gap is the empty graph. A buyer with no payment history has no trusted anchors, so there are no paths to follow and nothing to rank. Circle points to curated allow-lists as the starting point, while the paper itself notes that registries of vetted providers scale poorly once the volume of services outruns what human reviewers can audit. New providers face the mirror problem: until some buyer in the network has paid them, there is no path through which they can appear in anyone’s personalised ranking.
A ranking is not a review
Even inside its assumptions, the experiment measures something narrower than trustworthiness. It scores a method as correct when the provider it ranked first is the one the buyer paid next. That is a test of whether the ranking matches purchasing behaviour, and buyers routinely pay for data that turns out to be wrong, translations that are unusable and reports that never arrive. Each of those payments would still count as a hit.
“Previously paid” is not “independently reviewed,” and a strong Anduin score verifies neither the identity behind a provider nor the output it returns. The same gap Coindoo described between wallet inflows and customer revenue applies here: the chain records the transfer precisely and leaves its commercial meaning open.
In practice that puts payment-based reputation alongside two other controls rather than above them. Spending permissions cap how much an agent may pay. Rankings like Anduin narrow where it should look. Checking the delivered result is the only step that answers whether the purchase did its job, and a graph that is harder to game does not remove it.
What would turn the experiment into protection
Circle labels Anduin research, not a released service, and the evidence that would change that is specific. A deployment would need to show how the ranking holds up when a provider’s recommendations have been manipulated, how new buyers get past the allow-list stage, what happens when a trusted provider turns out to be colluding, and whether the providers it ranks highly deliver work that agents actually accept. The $8,259 figure answers one question well: how much it costs to fake a crowd. The harder questions start once the crowd is real.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
