Martín Casais

Martín. Stablecoin and payment infra on EVM and Solana. I also break DeFi protocols in audits. 18 open-source protocols shipped. 23 findings with working PoCs on a private audit. 4 in contests this year, 3 High. Site: martincasais.com Labs: labs.martincasais.com

The most powerful financial regulator on earth is a private company in El Salvador with no appeals process. Binance got drained last week. Before the FBI had a case number, Tether had frozen $3B of it. One employee, one button, no judge. Everyone cheered. I cheered. Now do the same math with a different headline. A protest fund. A journalist. An exchange in a country we don't like this year. Same button. Same employee. Still no judge. Bitcoin couldn't freeze a cent. The thief still has the other $3B and will keep it forever. That's the whole deal. You get money nobody can take from you, or money nobody can take from the guy who robbed you. Not both. Crypto twitter spent ten years saying it wanted the first one. Last week it found out it wanted the second.

Every time you tap your stablecoin card for a coffee, the guy behind the counter pays for your cashback. Not Visa. Not the issuer. Him. Nobody tells you this because the whole product dies the second you understand it. Most stablecoin cards are issued on credit BINs. The network sees a credit card and charges the merchant credit rates, about double what debit costs. Except there is no credit. Your USDC leaves at the moment you tap. The issuer takes zero risk, collects the credit fee anyway, and tosses you 3 or 4 percent so you keep tapping. That is not yield. That is not crypto. That is a bin number dressed up as a business model. Secured cards ran the same play a decade ago. Visa killed it. Merchants are already blocking these BINs again and the networks are drafting the rules right now. When the credit BINs go, the cashback goes. And most of these cards have nothing underneath. So here is the test for every crypto card in your wallet. Would you still use it at zero percent? If not, you never liked the card. You liked the subsidy.

Last week crypto found out it never wanted decentralization. It wanted a refund. Binance got robbed. Tether and Circle froze $2.7B in hours and the whole industry stood up and clapped. The same industry that spent 15 years telling you censorship resistance was the entire point. Bitcoin did exactly what it was built to do. It let the thief keep $1.5B. Nobody could stop it, so nobody did. That is the feature, working perfectly, and it made everyone sick. Meanwhile a centralized company with a blacklist function returned three billion dollars to actual people before lunch. Here is the part nobody wants to say. Your hardware wallet full of USDT is exactly as freezable as the USDT sitting on the exchange. The key you guard with your life controls nothing that matters. The company does. And after last week, the company knows it can press that button whenever it wants and get a standing ovation. We picked the button. We just hate admitting it.

Bitcoin protected a thief last week and USDT protected the victims. Sit with that. Binance lost $6.3B in about 20 minutes. By the time most of crypto twitter woke up, Tether and Circle had already frozen roughly half of it. Someone read the chain and pressed a button. Done. The $1.5B in BTC? Gone. Not frozen, not recovered, not pending. Gone. The design says nobody gets a button, so nobody got a button. I know that is the feature. Everybody knows. But say the sentence out loud with the number next to it: The centralized coin returned three billion dollars to real people in one afternoon. The sovereign coin made sure the attacker keeps his. You can still defend that. Lots of people will under this post. But you have to defend it with that number on the table, not with a 2017 meme about being your own bank. Stablecoin people, do not get smug. That same button works on your money. A company you never talked to can press it and the explanation is a support ticket. Freezable or final. There is no third option. Pick one.

Bitcoin did more for the Binance hacker this week than it has ever done for you. He stole $6.3B. The part he kept was BTC and ETH. The part he lost was USDT and USDC, frozen by two companies before midnight. Think about that for a second. The censorship resistant money worked exactly as designed. For a thief. The centralized money with a backdoor worked exactly as designed. For the victims. Everyone in this industry spent a decade saying the second one was the enemy. Now Tether and Circle are the only reason Binance users get anything back, and the "can't be stopped" assets are the ones sitting in a hacker's wallet forever. Nobody wants to say it so I will. Censorship resistance is a feature for people who expect to be on the wrong side of a freeze. If that's not you, you've been cheering for the wrong team.

Tether froze $971M of the Binance hack in four minutes and still lost the race. Not to a mixer. To Aave. The hacker didn't hide the USDT. He deposited it. 20:57, $60M into Aave. 21:01, Tether hits the freeze button. Too late, and it wouldn't have mattered anyway. Here's why. Tether blacklists addresses. The USDT isn't at his address anymore. It's in the aUSDT pool, same balance sheet as every honest depositor on earth. Want to freeze it? Freeze Aave. All of it. Every USDT ever deposited there, everyone's collateral, every borrow backed by it. Go on, press it. Nobody will. So the stolen money is now collateral earning yield. If he never repays and ETH moves, liquidators buy that USDT at a discount and it comes out the other side as clean, unfreezable balances in random wallets. Freezable stablecoins have an off switch. It works perfectly, right up to the first contract that mixes your money with everyone else's. Aave broke no rules. That's the part nobody wants to say out loud.

$6.3B stolen from Binance. The attacker never touched a smart contract. Bybit, $1.5B. Same. Ronin, $625M. Same. WazirX, $230M. Same. Every record-breaking hack in crypto history is just someone with a laptop that was allowed to sign anything. Protocols get audited for months. The key that can move the whole treasury gets a laptop and a Slack login. Stop asking if the contract is safe. Ask what one person can sign at 3am without anyone noticing.

Binance's $6.3B hack had zero stolen keys. That's not the good news. That's the whole problem. Every withdrawal was signed by Binance's own system. Same signer, same flow it uses ten thousand times a day. 17 wallets, 9 chains, four hours. Nothing was forged. Nothing was broken into. The attacker just asked and the system said yes. On Ethereum it went further. The signer approved EIP-7702 authorizations that let the attacker's code drive Binance's busiest hot wallet for 3 hours and 50 minutes. Fifty approvals. The system signed all fifty. The laptop everyone is pointing at doesn't matter. An engineer's machine reaching an internal service is normal at every exchange on earth. What's not normal is that nothing between that service and the signer could refuse. No cap per hour. No pause when 17 wallets drain at once. No human for four hours. Four hours. Bybit lost $1.5B in one transaction and the industry spent months on Safe's frontend. This one needed no trick. Just polite requests, signed on time. Custody worked perfectly. Policy didn't exist. A limit that lives in the code that gets hacked isn't a limit. It's a suggestion.

x402 is a vending machine. Everyone calling it the agent economy is describing a vending machine. Here's the tell. Every payment on it is too small to fight about. 1 cent per call, nobody cares if the response is garbage, you eat it and move on. The protocol works because nothing on it is worth disputing. Try a real payment. Agent pays $50 for a dataset, gets a CSV of nulls. Now what. The facilitator took its fee. The server kept the money. The client doesn't have a button for this. You go on Twitter and complain, that's the dispute process. Cards didn't beat cash because they were faster. They beat cash because you can call someone and get the money back. Every rail that ever won, won on the refund. So x402 stays where it is. Pay per call, pay per token, pay per tool use. Real volume, never a payment anyone would bother to argue over. Great business. Not an economy. The first team that adds a dispute layer gets called a suit by this timeline. Then this timeline routes every payment that matters through them.

If your agent paid for anything over x402 before August 18, a random API could have emptied its wallet and you'd have found out from the block explorer. That's not an exploit. That's how the default client worked. The API says 402, puts a price on it, the agent signs. The price could be your whole USDC balance. There was no check. Nobody had written one. A security firm found it in October. The foundation had patched it in August without saying so. The changelog calls it a feature. npm audit says you're fine. The patch is a $1 cap. Chosen by Coinbase. Now go back a week to everyone on here screaming at Mastercard for daring to put a limit on agent payments. Centralized control, suits ruining the protocol, the whole thing. The protocol didn't have a limit because nobody built one. The second someone did, it was Coinbase. Mastercard at least told you. You were never going to pick your own limit. You were only going to pick who does.

Ronin. Wormhole. Nomad. Initia. Four bugs. Same ending every time. The vault empties in one transaction because the bridge was built with no way to say no. That is the part that should get people fired. Not the bug. Bugs happen. Letting $2M walk in 7 minutes with zero ceiling on the exit is a design choice someone made on purpose. An hourly outflow cap is an afternoon of work. It does not stop the exploit. It turns a funeral into a bad Tuesday. Every team I bring this up with says the same thing. It hurts UX for whales. Which whale? The guy moving $100M across your bridge in a single block is not a customer. He is the attacker, and he is the only person who will ever hit that path. Six figures on audits. Zero lines protecting you when the audit misses. No ceiling on the exit means you do not have a security model. You have a countdown.

Mastercard just did to x402 what Visa did to Bitcoin in 2021. Nobody noticed because it came with a Base logo. The press release says agents pay in USDC on Base. Fine. Here's what actually happens: The agent signs a voucher under a limit Mastercard approved. The merchant collects a pile of vouchers and settles later, in batch. That's not a stablecoin payment. That's an authorization hold. The same thing that happens when you tap your card, except now it's wearing a crypto hoodie. x402's entire pitch was no intermediary deciding your limit and no gap between request and settlement. Mastercard kept both. Just changed the currency. And the ecosystem is cheering. The guys who built the protocol to kill the card are tweeting thank you to the card. Nine payments in the pilot. Nine. And the whole timeline is calling it adoption.

Everyone's bragging about shipping 10x faster with agents. In smart contracts nobody brags about that. The first deploy with real money is the only deploy. Fast just means you reach the bug sooner. The whole move fast era was built on being able to fix it tomorrow. Some code never gets a tomorrow.

USDC is the biggest admin key in crypto and nobody audits it. One address at Circle can freeze any wallet on earth. No proposal, no timelock, no multisig you can see. Tether has already done it for $2.5B+ and the number only goes up. Meanwhile every protocol spends six figures auditing reentrancy and then parks $500M in a token the issuer can brick with one call. We removed admin keys from contracts and put them in the money instead. GENIUS didn't close the backdoor. It wrote it into law.

Your USDC can be frozen faster than your bank account. Circle doesn't need a court order. Doesn't need to call you. One transaction and your address is dead. Can't send, can't receive, can't redeem. Tether goes further. Freeze first, burn the balance later. Your dollars don't just stop moving, they get deleted. Both are public functions in the contract. Anyone can read them. Almost nobody has. Not your keys, not your coins was the whole pitch. With stablecoins it's your keys, their coins. And the new US law doesn't ban this. It requires it. Every licensed issuer must be able to freeze on demand. Crypto spent 15 years building an exit from the bank. Then put the bank inside the token.

Agents are about to become the biggest bank customers in history and x402 people haven't noticed. Quick version. The OCC says a stablecoin can't pay you to hold it. A bank deposit token can. An agent sitting on USDC to pay per request is, by law, leaving money on the table every second. You don't need to convince an agent to move its idle balance into the thing that yields. You'd have to convince it not to. So the real agent wallet isn't a smart account full of USDC. It's a JPMorgan deposit token that spits out a stablecoin for half a second at checkout and sucks it back in. That's the bank account. We rebuilt the bank account, with worse ergonomics. Two years of "agents don't need banks" and the regulator just made the bank the rational default. January 2027. x402 is going to work exactly as designed. It's just going to be the bank's plumbing.

Mastercard just put a bouncer on stablecoins. Agents built on x402 were supposed to walk past him. The product shipped this week. A bank sends your USDC transfer, gets a score back, and decides if it lands. Their own number from 2025: 593 million stablecoin transfers on Ethereum, and close to 60% weren't a payment at all. Money bouncing between wallets before it got anywhere. Which is exactly what an x402 call looks like from the outside. Agent hits a 402, signs a transfer, data comes back. To a screening model that's a hop with no story attached. I've shipped on x402 and this is the part I got wrong. I thought the hard problem was budgets. The hard problem is that the protocol never says what the money was for, so now somebody else gets to guess, and charge for guessing. Stablecoins killed the middleman. He came back as a risk score.

Mastercard just told the agent payments crowd the thing nobody wants to hear: your agents are going to pay with a Mastercard. x402 was supposed to kill that. Pay per request, no card, no middleman, done in one signature. Their answer from yesterday is brutal in how boring it is. When software spends your money you want a button that reverses it. They've seen 175 billion transactions a year. A signature can't be reversed. That's the whole pitch. And who's listed on Mastercard's own agent network? Coinbase. The company that maintains x402. So the x402 maintainer is hedging with cards. Read into that what you want. Turns out chargebacks were never the bug.

Banks just paid for the thing that kills their best product. All 21 of them. Here is what happened this week, in order. Allium published Q3 numbers. Stablecoin payments hit $482 billion, up 45%. Stablecoin supply: up 0.4%. Flat since January. Standard Chartered saw the same data and moved its $2 trillion forecast from 2028 to 2030. And 21 of the biggest banks in the world confirmed they are funding a joint stablecoin for 2027. Crypto Twitter called it a bad week. No new money came in. I think it was the best week stablecoins have had, and the worst week banking has had in years. Flat supply and payments up 45% only means one thing. The same dollar is moving more often. Nobody is buying stablecoins to hold them anymore. They are buying them to send them. A bank does not make money on a dollar that moves. It makes money on a dollar that sits. The whole model is the sitting. You park your salary, they lend it out, they keep the spread, you get a toaster. A stablecoin that changes hands 20 times a month never sits. It never becomes a deposit. It never funds a mortgage. So why would 21 banks build one? Because the alternative is Visa building it. Which they did, on Wednesday. Then Mastercard on Thursday. Then Stripe. The banks are not launching a product. They are paying for a seat at the table where their deposits get decided. If you work in payments, your product just became a commodity. If you work in banking, your deposits just learned to walk. If you work in crypto and you are sad about supply, you are reading the scoreboard from the wrong sport. Which of the three are you?

I'll believe in personal agents the day one renews my driver's license. Not pizza. Not a flight. The DMV. Captcha, 2FA code to my phone, a form that only submits in Chrome and a PDF I have to print and sign. Every demo picks the one errand on earth that has an API, then calls it autonomy.