Private agent wallet
Private AI agent wallet
A private AI agent wallet is a wallet whose on-chain history cannot be linked back to the agent, the operator, or any other wallet the operator controls.
Private agent wallet setup
The agent never reuses an address. Two payments look like two different senders.
import { CropsAgent } from "@crops/agent-sdk";
const agent = new CropsAgent({
metaAddress: process.env.AGENT_META_ADDRESS,
spendKey: process.env.AGENT_SPEND_KEY,
chain: "base",
});
await agent.pay({
to: "0xRecipientMetaAddress...",
amount: "0.05",
token: "USDC",
});How a private AI agent wallet works
A private agent wallet has three parts: a meta-address that can be shared, a spend key that signs outgoing transactions, and a view key that lets the agent or an indexer scan for incoming payments.
When the agent pays, the SDK derives a one-time address from the recipient's meta-address using ECDH. When the agent gets paid, the payer does the same against the agent's meta-address.
Why default agent wallets leak identity
A naive agent setup is an EOA with a hardcoded private key. Every payment comes from the same address, which turns the agent's full transaction history into a public profile.
The first funding transaction also reveals where money came from. If it came from a known operator wallet or CEX deposit, the agent is linked to a real-world identity.
How to set up a stealth address agent wallet
Use one meta-address per agent, keep the spend key inside the runtime, and give finance or compliance a view key if they need reconstruction.
Generate one stable meta-address per agent.
Store the spend key in a secret manager.
Route every payment through a fresh one-time address.
Use a view key for scanning and audit.
How to fund a private agent wallet
The funding source is itself a leak vector. Fund the agent through a Curvy balance or another privacy-preserving path, then let the agent spend through stealth-routed payments instead of spending the funding output directly.
When you should not use a private agent wallet
Do not use this pattern when the agent is fully public by design and accountability is the point, when recipient infrastructure requires KYC at the destination, or when the agent makes one payment ever and has no history to protect.
Private wallet components
| Meta-address | Stable agent identity for deriving one-time addresses |
| Spend key | Signs outgoing payments from the runtime |
| View key | Scans and reconstructs payments for the agent or auditors |
| Relayer | Prevents one-time addresses from needing direct gas funding |
Frequently asked questions
What is a private AI agent wallet?
It is a wallet whose payment history cannot be linked back to the AI agent that owns it. A stable meta-address identifies the agent while payments use fresh one-time addresses.
How is it different from a regular EOA?
A regular EOA reuses one address. A private agent wallet routes each payment through a fresh address derived on the fly.
Can I use a private agent wallet with x402?
Yes. x402 is one of the core use cases for private agent wallets.
Is stealth-address routing legal?
The primitive is ECDH plus on-chain announcements. Compliance posture depends on jurisdiction and use case.