MPC Wallets for AI Agents, Compared (2026)

AI agents are getting wallets. Millions of them. The question was never whether an autonomous agent should hold crypto. It's who holds the keys when it does.

This stopped being hypothetical. Coinbase's x402 protocol crossed 100 million agentic transactions on Base around June 3, and sat near 169 million by July (Chainalysis, Crypto Briefing). Machines are already paying each other at scale.

So the stakes are simple. An agent that can sign transactions is an agent that can drain a wallet. All it takes is a prompt injection, a poisoned tool, or a bad instruction. Every serious "agent wallet" is really a bet on one thing: where the signing key lives, and who can move it.

Here's the split that matters.

Two architectures, one real difference

Most agent wallets in 2026 keep the key in a secure enclave on the provider's infrastructure. Coinbase's Agentic Wallets split the key with MPC and hold it inside an AWS Nitro Enclave: a CDP Server Wallet the agent calls through a signing API (Coinbase). Cobo runs MPC too, with an optional custodial mode for speed (Cobo). The enclave model is genuinely good engineering: even a fully hijacked agent can only sign within its policy, because keys never leave the box.

But the box belongs to the provider.

Vultisig draws the line somewhere else. Think of it like a safe that needs two of your own keys to open: one on the agent's device, one you keep, and the server (when there is one) can't open it alone. That's threshold signatures (TSS) in practice. The key shares sit on devices you control, split using the DKLS23 protocol from Silence Laboratories. No share ever sits alone on a server that can sign without you. No seed phrase to leak.

That's the difference between delegated self-custody and real self-custody. For a human, it's a preference. For an agent running unattended, it's the whole risk model.

What actually makes a wallet good for an agent

Strip the marketing and an agent wallet has to answer five questions:

• Key custody. Where does the signing share live, and can anyone move funds without the user's device? User-held shares beat a provider enclave when the funds are yours.
• Policy controls. Can you cap spend, scope contracts, and set per-transaction limits the agent can't exceed? This is table stakes now: Coinbase's Policy Engine, Cobo's "Pact" approval framework, and MetaMask's Guard Mode limits all do it.
• Chain coverage. Agents don't live on one chain. Coverage across UTXO, EVM, and Cosmos matters more than a single-ecosystem count.
• Developer surface. An SDK and a CLI the agent can actually call: non-interactive, JSON out, stable exit codes.
• Verifiability. Open source, or a black box you're asked to trust.

Hold the field against that list.

The landscape

• Coinbase Agentic Wallets / AgentKit. Strong policy engine, gasless settlement on Base, native x402 machine payments. Keys live in an AWS Nitro Enclave. AgentKit ships deep protocol support for three chains (Base, Ethereum, Solana) plus generic EVM/SVM compatibility (AgentKit). Base also shipped Base MCP in May, a gateway that plugs Claude, ChatGPT and Cursor straight into Base Account smart wallets through plain-language prompts (CoinDesk). The deepest distribution in the space, and provider-held keys.
• Cobo Agentic Wallet. The widest chain net at 80+ networks, with the Pact approval system that makes an agent commit to intent and policy before it acts (Cobo). Enterprise-grade, with that optional custodial mode.
• MetaMask Agent Wallet. CLI-first, non-custodial, in early access. Two modes: Guard (the default, with daily spend limits, allowlisted protocols, and 2FA when a transaction falls outside policy) and Beast (opt-in, fewer interruptions, security checks still running). Nine chains get the full mandatory security pipeline (Blockaid threat-scanning plus MEV protection), while trading reaches 25+ EVM chains and Hyperliquid (MetaMask). No UTXO or Cosmos support.
• Vultisig. Seedless TSS across 40+ chains spanning UTXO, EVM, and Cosmos. A TypeScript SDK plus a command-line wallet with a natural-language vultisig agent ask mode built for AI-to-AI use. Open source, end to end. A Secure Vault spreads shares across several of your devices with no server in the signing path; a Fast Vault gets an agent running on a single device in under a minute.

Give credit where it's due. Cobo casts the widest chain net, and Coinbase owns the developer mindshare. But both ask you to trust their infrastructure with the share that signs. Vultisig keeps that share on hardware you hold, and ships the source so you can check.

Judging MPC wallets generally rather than agent ones specifically? We ranked the whole field for 2026 separately.

Machine payments just became a standard

Why this matters now: agent payments stopped being one company's side project. On July 14 the Linux Foundation formally launched the x402 Foundation with 40 founding members, and the premier tier reads like the entire payments industry: Visa, Mastercard, Stripe, Google, AWS, American Express, Circle, Cloudflare, Coinbase, Ripple, Shopify, Solana Foundation (Linux Foundation, CoinDesk).

Everyone is standardizing the rails, in public, at once. Nobody is standardizing the custody model underneath them. That's the gap worth watching.

The part nobody else says out loud

The dominant pitch in 2026 is "your agent's keys are safe in our enclave." Read it again. The keys are safe in their enclave. That's a custody story wearing a self-custody label. Fine for some treasuries. Wrong for anyone who picked crypto to avoid exactly that. We made this argument at length when Coinbase, MetaMask, and Ledger all shipped agent wallets in the same week.

Insurance is where the gap shows most clearly. MetaMask now covers eligible losses up to $10,000 per month, capped at 100 transactions, which is a real consumer protection and more than most competitors offer. Read the exclusions though: coverage explicitly does not extend to a compromised or leaked recovery phrase or private key (MetaMask). The one failure that empties the account is the one the policy carves out. Architecture is what covers that, not terms.

No enclave you don't control. No seed phrase to phish. No provider with a key that signs.

Real self-custody always forced a tradeoff: you control your keys, but you can't automate. Threshold signatures dissolve it. The agent signs with its share; you hold yours; the math needs both. Self-custody and automation, finally in the same wallet.

You don't have to be building an agent

The custody question is sharpest for autonomous agents, which is why this comparison focuses there. But the same SDK answers a far more common need: your project wants a wallet and you don't want to build key management. DeFi frontends, treasury tools, trading bots, games, dashboards. Same seedless MPC underneath, with keys that stay with the user rather than with you.

That's a separate piece: how to add a multi-chain wallet to your app without holding keys.

Give your agent a wallet

A Vultisig wallet is a few lines from the SDK, or one CLI call:

• npm install @vultisig/sdk: vault creation, signing, swaps, balances
• vultisig create secure: shares split across your own devices, no server in the signing path. This is the one to run an unattended agent on.
• vultisig create fast: a working wallet on one device in under a minute, no seed phrase anywhere. Server-assisted 2-of-2, so VultiServer co-signs and can never sign alone. The fastest way to get an agent live.
• vultisig agent ask: natural-language control for AI-to-AI flows

The docs and source are public (SDK, agent guide, developer docs).

Agents are going to move money. So are a lot of apps that aren't agents. The only question worth arguing about is whether they do it with keys you hold, or keys you rent. We built for the first answer.