How AI Agents Transact Securely: Four Controls That Matter

An AI agent transacts securely when no single compromise can drain it. In practice that takes four controls. Split the signing key so no complete key exists. Fund the agent from its own budget. Put a human or a second signer in front of large moves. Show every transaction in readable form before it's signed. Each one covers a failure the others miss.

Here's why each one matters, with the incidents that taught the lesson.

First, what "agentic tokens" means

The phrase gets used two ways, and they're different problems.

Some people mean tokens issued for AI agents. Virtuals Protocol, for example, lets founders "tokenize AI agents and AI-native businesses directly onchain", with each launch starting on a bonding curve. That's a question about the token's market.

Most people asking how agentic tokens "secure AI transactions" mean something else: how an agent holds and spends crypto without becoming the easiest wallet on the internet to rob. That's a custody question, and it's what this article answers.

Why agent wallets fail

A human signs a few transactions a week and reads them first. An agent signs whenever its code tells it to, and its code takes instructions from text it reads. Two public incidents show the two ways that goes wrong.

• Talked out of the money. In November 2024, the Freysa challenge gave an AI agent a prize pool and one rule: never transfer it. After 482 attempts from 195 players, one message redefined the transfer function as a way to receive funds. The agent paid out about $47,000 in ETH (Cointelegraph).
• Robbed around the agent. In March 2025, attackers got into a dashboard behind the AIXBT agent and queued malicious replies. 55.5 ETH, about $105,000, left the wallet. The developer said it "was not a result of agent manipulation". The agent's surroundings were the weak point.

One case is a prompt attack and the other is an infrastructure attack. Both end the same way if the agent's wallet can sign anything, any time, for any amount.

The four controls

1. Split the key so no complete key exists

Think of a safe that needs two keys turned at once. Steal one, and you have a piece of metal.

That's what multi-party computation (MPC) does for a signing key. The key is generated in shares, and a threshold of shares produces each signature. No complete key ever sits on the agent's host to copy. We build Vultisig this way. A Fast Vault pairs the agent's share with a VultiServer share, so the agent can sign unattended while VultiServer co-signs and can never sign alone.

MPC removes the stolen-key problem. As our agent docs put it, it does not make an agent's decisions correct. That's what the next four controls are for.

2. Give each agent its own budget

Fund an agent like a prepaid card, not like your main account. A separate vault per agent, or per strategy, holding only what that workflow needs, caps the worst case at the budget. If the agent is tricked, the loss stops at the edge of its wallet.

3. Put a second signer in front of large moves

Some actions shouldn't be autonomous. Moving a treasury, adding a new destination, signing something irreversible. For those, the agent prepares the transaction and a human approves it.

A Vultisig Secure Vault is built for this. Every share sits on a device you hold, and a signature needs the threshold. The agent can draft a transaction all day. It doesn't move until your device joins the signature.

A common setup runs both: a small Fast Vault the agent spends from on its own, and a Secure Vault that holds the reserves and needs a human.

4. Show every transaction before it's signed

Blind signing is how a wallet approves something nobody read. For agents, that means two things. Log and preview each transaction in readable form before it reaches the signer. And treat open-ended message signing as a high-risk capability. A signed message can authorize a transfer just as a transaction can.

Putting it together

• Key compromise. Split keys mean there's no complete key to steal from the agent's host.
• Manipulated agent. A separate, small budget bounds the loss.
• High-value mistakes. A second signer stops them before they're final.
• Hidden payloads. Previews and no blind signing catch what the agent didn't understand.

No single control covers all four. That's the point of stacking them.

FAQ

What are agentic tokens?

The term has no single standard meaning. It can mean tokens issued for AI agents, such as Virtuals Protocol agent tokens, or the broader question of how agents hold and spend crypto. Securing agent transactions is about the second: key custody, budgets and approvals.

Can an AI agent hold crypto safely?

Yes, if no single compromise can drain it. Use split-key (MPC) custody, a separate funded budget and human approval for large moves.

What is the biggest risk for AI agent wallets?

An agent that can sign anything, for any amount, at any time. Prompt injection and infrastructure breaches have both drained agent wallets. The fix is limiting what any one compromise can sign.

Does MPC stop prompt injection?

No. MPC stops key theft. Prompt injection tricks the agent into requesting a bad transaction, so it needs a small budget and approvals on top.

How does Vultisig secure AI agent transactions?

The agent's key is split into shares, so no complete key exists on its host. A Fast Vault lets an agent sign unattended with VultiServer co-signing. A Secure Vault requires your own devices to approve each transaction.

The agent signs. You decide what it can sign.

Agents will hold money. That's already happening. The wallets that survive are the ones where a single bad prompt, leaked token or compromised server can't empty the account. For a deeper look at who holds the key across agent wallets, read MPC wallets for AI agents, compared.