When Your Agent Spends Your Money, Who's Liable?

Korea Blockchain Week brought a wave of overseas companies into Seoul. Bloom isn't a blockchain community, but we'll work with anyone whose problem touches AI, and that's how we ended up co-hosting Agentic Payments Onchain with Ripple, t54 and Tenity. We wanted to spend as much time on the legal mess that shows up when an AI agent pays for something on your behalf as on the technology that makes it possible. So we invited Next Securities, who join our events often, for a fireside chat.

A blockchain that put the features in the core instead of in smart contracts

Joel Mun introduced himself as a developer who helps other developers, and he opened with the XRP Ledger. It's been running for fourteen or fifteen years, its speed and cost and stability have all been tested in production. The source code is fully open. Then came the line that tells you the most about what kind of chain it is. Most blockchains expect you to build your application with smart contracts. The XRP Ledger doesn't have them.

People ask me how on earth you're supposed to build an application, then. We put all the features into the core of the blockchain. So the only thing you have to do as a developer is connect.

Payments and token issuance are already in the core. You connect and call the API. Agent payments are running on the ledger in real volume. Mun had checked that morning and found 9 million x402 transactions. A week or two earlier the team shipped version 1.2 of the XRPL AI Starter Kit, which bundles the tooling for agent payments and AI development. t54 has open-sourced an x402 SDK. The MPP SDK from Stripe and Tempo is supported too.

You can pay with XRP directly, and RLUSD, Ripple's stablecoin, is running about $2.3 billion in agent payments. Mun went out of his way to add that it's still chasing the competition.

Bomin Kim from Tenity had flown in from Singapore that morning. Tenity is headquartered in Zurich and works across six countries including Singapore, connecting startups with financial institutions through PoCs and pilots while investing in them as well. Since 2023 it has backed builders in the XRP Ledger ecosystem alongside Ripple. The more transactions agents handle for us, Kim said, the more trust between people matters. Finding good companies, matching them with the right partners and helping them grow on stable infrastructure is the job Tenity sees for itself in the agent era.

Who pays for the money your agent spends

Claire Jung from t54 had five minutes and ran. t54 is a Silicon Valley AI fintech, and she wanted one thing clear up front. They talk about agent payments constantly, but they aren't a payments company. They build the trust layer that manages risk between the financial system and service providers. Ripple is both an investor and a customer. Mastercard is a partner.

Trustline, their institutional product, starts by asking who the agent is. That means the agent itself plus whoever owns it and whatever execution environment it runs in. If a hacker owns the agent, you're finished. Next comes the scope the user delegated. Last comes the evidence you'll need when somebody disputes the charge later.

You tell your agent to buy you a $10 pair of golf shoes, and it can go off and spend $100, or $1,000.

That's why the system re-checks whether an action was really the one the user authorized. Chargebacks, where you go to your card issuer after the fact and get your money back, are coming to agent payments too, and nobody has decided what counts as evidence or how any of it gets resolved. The XRPL AI Hub shows developers live transaction activity and the list of onboarded merchants. If you're building on the XRP Ledger you can register as a merchant and go through review. The site works in Korean, machine-translated and then checked.

Sergio Chan, t54's founder, showed what it looks like in practice. No abstractions, he said, just one real transaction end to end. He wrote no code. He pasted a handful of prepared natural-language prompts into Codex and had a research agent. The agent went to the XRPL AI Hub on its own, found paid inference services, picked a DeepSeek model and pulled an x402 quote.

He had set a spend cap of 0.01 RLUSD, and he pointed out that the number is a ceiling rather than a price, since pricing is dynamic and the merchant sets it. He approved. The agent answered the question and settled the payment on XRP Ledger mainnet at the same time, and the explorer showed the transaction along with a memo carrying the invoice ID.

Chan said it twice: you can become a merchant, sell services to agents and make money without knowing how to code. x402 also runs on Base and Solana, and Visa and Mastercard are both adopting it. He named two things that are different on the XRP Ledger. Merchants can opt into having every agent transaction pass t54's risk screening by default. And there are credit accounts. The ledger requires every wallet to hold 1 XRP in reserve, which is a natural barrier for an agent, and a credit account lets one reach the ledger's AI services without creating a wallet at all.

Somebody in the audience asked where the money is right now. People need water and food; agents need inference and compute. So inference, compute and the model brokers that offer something cheaper than OpenAI and Anthropic are where the need and the money sit today. Chan added a caveat. Meta has just put out Muse, and Instinct came before it. Within two or three months people could be handing their grocery runs and ticket bookings to agents, and traditional businesses would have to start earning from traffic that arrives from agents rather than from people.

Asked how this differs from KYT and the anti-money-laundering services that already exist, Chan said KYT, KYC and KYA are all just signals feeding a risk engine. What a risk service is worth is the approve-or-decline decision, the risk level attached to it, and the evidence you use later to assign blame in a dispute. t54 is closer to an aggregator, wiring in two or more KYT services as sources. Fiat transactions can be agent transactions too, which is part of why Mastercard is in the picture.

The clearest answer came from someone who said the core idea still wasn't landing and asked for a plain explanation using Muse. Twitter is already full of complaints about agents booking the wrong flight and leaving the user with the cancellation fee. With a credit card the situation is different. Hand your card to somebody, let them buy the wrong ticket, and you file a dispute and the issuer eats the loss.

The agent is a new participant in this flow, and nowhere has anyone defined its liability.

If t54 approved and vouched for a transaction, then t54 plays the issuer's role when the user disputes it. It protects the consumer and the merchant at the same time, and Mastercard saw exactly that gap, which is why the two are working together.

Why a blockchain instead of a card

The panel: Junhyuk Yu of Four Pillars, who wrote a 120-page report on x402; Sunmin Lee, CEO of Future Works Lab, visiting professor at Inha University and an advisor on AI agent commerce to the Ministry of Economy and Finance; and Jeongyong Eom, who leads Web3 development and the AI task force at DSRV. The first question was the obvious one. Card networks exist and payment methods are everywhere, so why does an agent need a blockchain at all?

Yu started by refusing the premise that x402 competes with cards. Coinbase built it, the Linux Foundation has run it since this year, and roughly 50 organizations have signed on, including Visa, Mastercard, American Express, AWS and Cloudflare. One of the working groups is a card group led by Visa and Mastercard, which tells you the direction. Visa and Mastercard already have agent payment protocols ready. Handing an agent your full card credentials is dangerous, so they put an intermediary in the middle to handle the card data, and x402 does the same.

Whatever situation an agent lands in, if it doesn't hold the payment method that fits that situation, that's the biggest problem you've got.

Payment neutrality, and solving it, is what Yu finds most compelling about x402. Eom picked up a different thread. Blockchains were built on the assumption of anonymity in the first place. Hold one 32-byte private key and you hold a payment method. Cards and bank accounts were designed for people, and even the agent-focused financial systems being built now assume a person sits behind the agent and delegates to it. So the only place an agent can hold a payment method fully in its own right is a blockchain, and agent payments are the entry point to an agent economy and agent finance.

He added the idea of programmable money. Anyone who has used an agent has watched it take a task and write its own script to get it done. Money has to be composable and executable the same way for an agent to really work, and blockchains have that tooling in better shape.

Lee had spent that afternoon teaching Understanding Digital Assets to undergraduates at Inha, and he repeated the exchange he'd had with them. Tell a room that an era of agents trading with agents needs money machines can read, and that it'll be stablecoins, and somebody always asks why you can't just top up a prepaid balance.

Sure, top up your Starbucks card. You can only spend it at Starbucks. Top up Naver Pay. You can't buy anything on Amazon with it. My agent doesn't only trade inside Korea.

Prepaid balances fence in where the money works. An agent that never sleeps can scour the world, find the right thing and then fail to pay for it. Lee's second reason was the Merge Point and TMON-WeMakePrice collapses. Having someone in the middle is itself a risk, and a blockchain is technology for making things trustworthy when you trust no one.

With a prepaid balance, giving your son an allowance means deciding in advance where he can spend it. With a stablecoin you hand him a rule instead: nothing after 10 p.m. Forgery is far easier in the digital world than offline, so proving trust digitally means moving onto a chain in the end.

The API market opens before shopping does

So where do agent payments land first? Yu pointed to Google's Universal Commerce Protocol, which contains AP2, an agent payment protocol that can settle over x402. Ordinary shopping still isn't a good fit. Blockchain transactions can't be reversed, and you have a problem the moment somebody wants a refund on the wrong item or a delivery failure turns into a chargeback. In Korea nobody has even settled whether the agent counts as the paying party.

What you can see in the US is the API market. The x402 volume Yu had checked recently came to about $55.1 million, and most of it came from APIs. Number one was BlockRun AI, a marketplace for buying and selling API access. Subscribing to Claude or ChatGPT takes credentials and several steps. BlockRun AI takes an x402 payment, routes your request to whichever model you want and hands back the answer. While the rules and the permissions are missing, stablecoin micropayments are strongest in markets that need small, fast responses rather than in commerce where you're buying clothes or a TV.

Eom brought up Cloudflare's Pay Per Crawl. When a web crawler scrapes a site, the site used to have two options: block it, or leave the door open. Pay Per Crawl created a third. Pay if you want to crawl. The crawler hits the page, gets a 402 back, pays over x402 and then has permission. Eom's point wasn't that Pay Per Crawl earns big money. It's that a market opened where there had been no mechanism at all. Data and APIs that used to sit behind a block, or behind a contract too complicated to bother with, can now be opened to agents one transaction at a time.

There's work nobody has ever done because it takes too much human effort for too little value. Old bots could only fetch quantitative things. Agents make qualitative judgments. So a market opens for capturing small value that used to be uncatchable, at a lower cost, with agents doing the catching.

Lee turned the mood back to Korea. Raise payments at an advisory meeting, he said, and the first thing you hear is that we don't even have agents yet, so what are we talking about.

We're still asking each other, "What do you use?" In the US they ask, "How many agents do you have? How many of them are doing your work for you?"

On the five-step AGI ladder of chatbots, reasoning, agents, innovation and organizations, Korea is still on step two. Agent payments in the US grew sevenfold in a year. In Korea, Naver has been running agent shopping for three months and nobody knows, because it works inside Naver and outside agents are locked out.

Lee is writing policy recommendations, and he listed a few. You need rules against prompt injection aimed at your agent, the kind where a fake Trip.com agent appears in front of the agent you sent to book a business trip, or where it gets talked into spending past your 500,000 won cap. When a payment goes wrong, nobody knows whose fault it is. And Korea has no API market for an agent to spend money in, which is why the calls to open APIs keep getting louder.

Where refunds and spending caps get handled

So who fills the gaps? On the criticism that the x402 spec has no concept of a refund, Eom said the parts people consider necessary keep getting added to the protocol. The docs cover one-shot payments, payments up to a set amount, and off-chain settlement. Look at the implementations and you'll find authorize-then-capture as well, and commerce-level refunds are being researched. Whatever the protocol never absorbs has to be worked out at the service and infrastructure layer.

Spending caps can already be handled at several layers. In Google's AP2 the limit you set when you create the delegation is the spending cap. DSRV puts per-transaction and daily caps into its agent infrastructure, stopping it at the tool layer the agent uses. On-chain there are smart accounts, so a per-payment limit, a 24-hour limit or a daily transaction count can live in the account itself. MPP, from Stripe and Tempo, exposes custom types that let you define your own payment type, so you can build a payment method carrying whatever rules you need.

Lee took on KYA, the thing that arrived after KYC: knowing your agent. If handing over your ID at a bank is KYC, then in an era where your agent pays instead of you, somebody has to verify whose instructions this agent is carrying out and how far it can go. An agent that needs to transact with Booking.com has to tell a fake Booking.com apart from the real one, and Lee thinks reputation ends up mattering most. You accumulate a history of what it has transacted before and whether any of it was travel or airline related. Ethereum people are discussing standards for recording agent reputation and behavior too.

Proving that someone is a person is back on the table as well. In the US, agents posing as students have paid tuition, submitted assignments and collected state aid, and California alone lost $10 million that way. Hearing that Sam Altman had been talking about proof of personhood through Worldcoin since 2018, Lee said, made him think the man had a plan all along.

Yu walked through the x402 order flow. The best thing about x402 is that a merchant who knows nothing about blockchain payment infrastructure can open an endpoint and let a facilitator handle the money. But a facilitator in the middle changes who pays first and who delivers first, and the current spec assumes everyone is honest, so the work happens before the payment arrives. Anyone determined to abuse that can burn a merchant's resources with fake payments.

A merchant like Cloudflare, big enough that nobody worries about it defrauding anyone, can take payment first, and the flow is something the merchant can change at any time. How an agent then judges that service is a separate question, which is why Yu expects trust scores between agents and merchants to become very important.

Korea is still in the pre-agent stage

The last topic was whether any of this is real, and if so, when. Lee laughed and said there's no timeline. He'd submitted a five-year plan and doesn't know whether it passed. With people saying AGI arrives in 2030, nobody knows what five years out looks like. Instead he went back to the Digital Signature Act of 1999. E-commerce barely existed then, but Korea laid the infrastructure first with the act and the public certificate system, and Korean commerce shot up. The problem was the next twenty years, spent stuck on ActiveX. The canonical example is the Chinese shoppers who wanted the coat from the drama and couldn't check out.

We were fast, but the lesson we took was that you don't build a Korea-only standard. Nobody else adopts it.

So the Ministry of Economy and Finance is arguing that Korea needs a stake in international standards discussions like x402. The counterargument is that you can just use whatever gets built. Lee's answer is that a stake is what lets you know what's coming next and prepare for it, and speak up about the parts that don't fit Korea.

Yu went back to 21.co in 2015. Balaji Srinivasan co-founded it, Coinbase later acquired it, and the thing it tried and failed to build was a market of agents making micropayments in Bitcoin. Fees started under a dollar. Then Bitcoin interest exploded in mid to late 2015 and the math inverted.

You buy one service for 1,000 won and the fee comes out at $100. It doesn't work.

There was no reason to buy somebody's API in that marketplace specifically, so demand never showed up. What's different now, Yu said, is that several high-performance chains settle transactions fast for a few cents. A consumer class called agents has also appeared. The gap between that and how it feels to actually use an agent is still wide, but now that the potential customer exists, paying attention is what keeps you from being late when the wave does arrive.

Eom split his case for optimism into quantity and quality. Meta has said it will make Muse free, and Korea has declared an era of one agent per person, so access keeps improving. On quality, build a game with GPT-6 Astra and you get detail instead of the strange lumps of polygons you used to get, and AI-made ads, shorts and dramas keep multiplying, a long way from the era of the weird video of Will Smith eating spaghetti. His decisive reason for expecting paid API demand to grow was somewhere else.

Everybody's paying for the same ChatGPT or the same Claude and using it the same way. Can you be confident that what you make with it looks different from what the person next to you makes? It won't. It comes out almost identical.

Data you can scrape for free is worth only so much. Making something even slightly more valuable means paying for more valuable data to feed in. That requires agents to reach that data and pay for it easily, so demand for paid APIs and data markets can only grow.

The three closing statements ran at different temperatures. Eom said it's a market where things that never worked are opening up, so there's a lot of opportunity. Yu wasn't arguing that payment volume won't grow, but he drew a line. Whether blockchains hold a moat inside that growth is a separate question. Agents will reach for cards by default too, so you either dig into a new market that fits stablecoins well, like APIs, or you hope a big tech company like Cloudflare pulls hard. Lee's closing was one sentence.

It's coming. It's on its way. But get a full step ahead and you die. Get exactly half a step ahead and grab the bottleneck.

A payment your AI made is a payment you made

For Bloom's segment, Junsu Kim introduced the community briefly and then sat down with Suhan Cho, chief compliance officer at Next Securities. Developers worry about whether something is technically possible. People running businesses worry about whether it's allowed in Korea, and the idea was to put that question to a lawyer. Cho introduced himself as the youngest chief compliance officer at a Korean brokerage. He'd meant to become a judge, then saw the business world during a Dubai posting in his judicial training days, figured that was where lawyers would be needed, and worked through Hanwha Life, KakaoBank and a crypto trading firm before landing at a brokerage.

The common wisdom is that it's fine if the AI asks and you approve, and not fine if it acts alone. Asked where the legal line actually sits, Cho's first answer was that nothing here is fundamentally prohibited or restricted. The baseline is that you're responsible for your own actions. UNCITRAL's model law on automated contracting recognizes the formation and performance of contracts made using AI and requires that automated means not be discriminated against. Article 7 of Korea's Framework Act on Electronic Documents and Transactions says anything sent by a computer program configured to send and receive electronic documents automatically counts as sent by the person behind it.

Even if it trades and pays with a frequency no human could follow, and things happen while you're asleep, the international consensus is that your counterparty treats all of it exactly as if you'd done it yourself.

What's prohibited depends on who built the agent. Brokerages have always had algorithmic trading and quant strategies that execute dozens of times a second in ways people can't follow, and there's no issue with a user assembling one for themselves. Sell that algorithm to someone else and Korea requires a license for investment advisory or discretionary investment management. People selling trading bots on Instagram can claim they only sold software; the law treats them as quasi-investment advisors and regulates them accordingly.

Asked what happens when you cross the line, Junsu Kim volunteered one of his own. He's been handing restaurant reservations to Codex lately. He gave it the budget, the private room, the headcount and the distance, and the agent went into Naver TalkTalk and laid the whole list out for the owner, asking whether that would work. He panicked, apologized, told the owner not to worry about it, then shut it down.

Cho sees refund protocols and other mechanisms against mistakes and abuse in development, but the area is still unsettled risk. Someone who jumps in on their own is presumed willing to assume that risk, and accidental outcomes from a badly built setup land on the builder as a matter of principle. Korea's Electronic Financial Transactions Act holds operators liable for payment system errors even when they did everything right. Agents get built by individuals, so neither the infrastructure operator who wrote the protocol nor the centralized platforms we're used to can carry that liability. Even when the other side is at fault, you're left having to pursue that person yourself.

Why stablecoin payments are stuck in Korea

Asked why the US gets services where agents pay in stablecoins on their own and Korea doesn't, Cho started where Yu had. Stablecoins and agent payments are separate agendas. Stablecoins have no legal basis in Korea yet. Rules for issuing and circulating a won stablecoin have been under discussion for two years with the legislation going nowhere. The US built its basis with the GENIUS Act. Stablecoins like USDT exist, but handling them means registering as a virtual asset service provider. Running a payment business on virtual assets is technically possible, and with no ecosystem Korea has only three categories: exchanges, custodians and wallet providers.

Meeting the regulatory bar the government sets is hard enough, and with no revenue there's nothing left over to invest in new infrastructure. Even a company the size of Naver, which owns Naver Pay, would have to start over as a registered virtual asset service provider, so everyone is waiting at the starting line.

Agent payments are conceptually possible today, and you can experiment and build a business on them. What's badly missing is any way to make victims whole or resolve mistakes. With no centralized operator, the E-Commerce Act struggles to protect anyone, the Electronic Financial Transactions Act isn't a law built for this ecosystem, and the Digital Signature Act gives you only the most basic concepts. So anyone who jumps in runs a business without legal protection while participating as a consumer without it too.

Cho expects that once private activity picks up, the Financial Services Commission, whose priority is protecting financial consumers, will try to design rules from a centralized perspective, and the rules will take more time to catch up. On operators who invest early and can't hold on, he pointed at the financials of Korean virtual asset businesses from 2017 to 2022. Apart from one or two exchanges, almost none grew enough to fund themselves through four or five years of waiting for a framework with no revenue model.

Asked whether brokerages are preparing for an on-chain era the way Mirae Asset did by acquiring Korbit, Cho said brokerages exist to deliver value through investment in the capital markets that exist now, so they aren't the ones researching new protocols first. What they did do, the way BlackRock built a Bitcoin ETF first, was treat virtual assets as an investable asset class, and in the US buying and selling stocks with stablecoins through an exchange has become somewhat possible. A brokerage's main interest is tokenizing every asset that can be securitized, because tokenizing makes identity verification easier and leaves transactions on the record.

Asked for the one rule anybody letting an AI agent pay or trade should follow, Cho said set your risk limit first. None of us is the furthest ahead, so you need standards somebody else recommends and helps with, and inside those there's still a line you have to draw yourself.

Set a limit you can actually be liable for. Work out how much you can absorb if the outcome isn't what you intended, and build that into a protocol or an algorithm.

How to make people whole after the fact is a problem for the government and legislators to work through, and what an individual can do right now is prevention. Next Securities is building an MTS, aimed at people who want API trading, with customers who express their intent through AI agents as the core user.

t54 answers with guarantees and evidence. The protocols answer with caps and refund mechanisms. The law answers with the principle that you're responsible for your own actions. Nobody yet has a single place where the question of who pays for what an agent spent gets resolved, and whoever fills that blank first will set how fast agent payments come down to shopping.

Join Bloom

Bloom builds offline rooms where people and technology meet. We run them in Seoul, and now beyond it.

• 💬 Discord community, where events are announced first
• ▶️ YouTube, full talks from past events
• 📸 Instagram, photos from our events
• 🎟️ Upcoming events