Disclaimer: Personal analysis based on public filings and technical documentation. Not financial advice, not affiliated with Coinbase. I could be wrong about all of this.
Two months ago I wrote about Coinbase's infrastructure pivot: the x402 protocol, CDP Wallets, Base sequencer economics. The thesis was that Coinbase was quietly building payment infrastructure while everyone watched the trading numbers. Now we have a quarter of data. The technical story got more interesting. The competitive landscape got harder.
The subscription and services line hit $2.83 billion for the year, 5.5 times its 2021 cycle peak. Twelve products now generate over $100 million in annualized revenue, up from two in 2019. That breadth matters architecturally: when spot trading volume drops (Q4 consumer spot was down 6% sequentially), derivatives volume hits all-time highs through the Deribit integration. When staking yields compress, USDC transfer volume hits records. The system is starting to self-balance. Starting.
But the most consequential developments since January aren't about Coinbase's own execution. They're about who showed up to compete for the stablecoin infrastructure layer.
The middleware gap is real
Mastercard acquired BVNK on March 17 for up to $1.8 billion. BVNK is the part of the stablecoin stack that most crypto people don't think about: the middleware between on-chain settlement and traditional banking systems. Multi-chain transaction routing, fiat on/off-ramp orchestration, KYC/KYT compliance pipelines, cross-border settlement across 130+ countries. They process $30 billion annually in stablecoin payments and were already embedded in Visa Direct's pilot programs.
Coinbase tried to buy BVNK for $2 billion in October 2025. Exclusivity, due diligence, the whole process. Both sides walked away in November. Four months later, Mastercard locked it down.
Think about this as a stack. Coinbase owns the issuance layer (Circle/USDC partnership), the settlement layer (Base), and the protocol layer (x402). What it's missing is the middleware that translates between on-chain settlement and legacy payment rails at enterprise scale. That's the layer BVNK operates at: a business sends a payment through BVNK's API, BVNK routes it across whichever chain has the best fee economics, handles the fiat conversion on the receiving end, and manages the compliance paperwork. The middleware layer is unglamorous but load-bearing.
Visa is building in parallel. Bridge (Stripe's stablecoin platform, acquired for $1.1 billion) is expanding stablecoin-linked Visa cards to 100+ countries. Bridge got conditional OCC approval to custody crypto and issue stablecoins, giving it a regulatory moat. Visa's stablecoin settlement volume hit $4.5 billion annualized in January, growing 29% in two months.
Coinbase's counter is the white-label stablecoin product: banks issue branded stablecoins backed by USDC on Coinbase infrastructure. Clever architecture because it makes USDC the reserve asset layer while Coinbase captures infrastructure margin on every branded token built on top. The question is whether banks adopt it or build their own once the GENIUS Act rulemaking finalizes in July.
The honest assessment: Coinbase has deeper crypto-native infrastructure than Visa or Mastercard. But networks processing $9 trillion annually just started buying their way into stablecoins, and they move fast when they decide to.
x402: beautiful protocol, negligible economics
I was bullish on x402 in January and I still think the protocol design is right. Quick recap: client sends HTTP request, server returns 402 with payment terms in a structured JSON payload (amount, accepted tokens, recipient address, network, timing constraints), client signs and submits a transaction on-chain, resubmits the original request with payment proof in the X-PAYMENT header, server's facilitator verifies, resource gets served. End-to-end under 2 seconds on Base.
V2 shipped with meaningful architectural upgrades. Wallet-based identity (the agent's wallet address becomes its persistent identity across services), automatic API discovery via .well-known/x402 endpoints, dynamic payment recipients, multi-chain support across Base, Polygon, and Solana, and a modular SDK that plugs into LangChain, OpenAI Agents SDK, and Anthropic's tool-use patterns. The protocol expanded from USDC-only to any ERC-20 token. Cloudflare co-founded the x402 Foundation for protocol governance.
The comparison to L402 (Lightning Labs' 2020 protocol) is instructive. L402 uses Lightning payment channels for settlement: low latency, proven scale, but constrained to Bitcoin-denominated payments. You can't price an API call in dollars without exchange rate risk. L402 also requires the server to generate a Lightning invoice per request and the client to manage channel liquidity. That operational overhead breaks down for autonomous agents transacting across hundreds of services. x402's decision to use stablecoins on L2s eliminates the denomination problem. A $0.001 API call costs exactly $0.001 in USDC.
Sam Altman's World project integrated x402 on March 17 to add cryptographic proof-of-personhood to agent transactions. The technical flow: the agent's wallet presents a World ID proof (generated by iris scan), the x402 facilitator verifies it on-chain, the resource server can differentiate between human-backed and autonomous agent requests. This addresses a real problem: how do you prevent Sybil attacks on pay-per-use APIs? If an agent can prove it's operating on behalf of a verified human, service providers can offer differentiated pricing and trust levels.
But a CoinDesk investigation found that roughly half the observed x402 transactions are gamified: developer testing, airdrop farming, bot activity. Daily dollar volume is about $28,000 across 131,000 transactions. Average payment: twenty cents. The 100 million cumulative transaction count looks impressive until you do the division.
The protocol is technically sound and well-integrated with major cloud infrastructure (Stripe, Google Cloud, Cloudflare). But every internet protocol starts with negligible traffic. HTTP itself carried zero commercial volume for years after RFC 2616. This is an 18-24 month bet on whether AI agent commerce materializes at scale, not a current revenue driver.
Agentic Wallets solve the right security problem
Coinbase launched Agentic Wallets in February and the security architecture is worth understanding because it gets the threat model right.
Private keys use Coinbase's MPC infrastructure where keys split into shares distributed across multiple secure environments. Full keys never reconstruct, not at rest, not during signing. The Threshold Signing Service (built on primitives from the 2021 Unbound Security acquisition) generates valid transaction signatures from key shares without assembling the complete private key. For secp256k1 (Ethereum, Base): multi-party ECDSA. For Ed25519 (Solana): threshold signature scheme.
The critical design decision: key material lives in hardware-backed secure enclaves. The agent's LLM prompt, context window, and tool outputs never touch key material. A prompt injection attack against the AI agent cannot extract private keys because the keys physically cannot leave the enclave. The signing request goes in, the signed transaction comes out. The attack surface reduces to the policy layer (spending limits, allowlists), not the cryptographic layer.
Programmable guardrails enforce session caps, per-transaction limits, token allowlists, recipient allowlists, and KYT screening at the infrastructure layer before transactions hit the blockchain. The agent cannot override them through prompt manipulation.
AgentKit, the open-source SDK, abstracts blockchain interactions into tool definitions that LLMs invoke naturally. "Send 5 USDC to 0x..." becomes a tool call, not a raw transaction construction exercise. Framework-agnostic (LangChain, OpenAI Agents SDK, Anthropic tool-use, CrewAI) and wallet-agnostic (Agentic Wallets, self-custodied wallets, third-party MPC providers).
This is the right architecture. Whether agents actually need to hold and spend money at scale in 2026 is still an open question, but the security model is production-grade.
Base won the L2 war. The sequencer question remains.
Base now commands 70% of all L2 active addresses, 46.6% of L2 DeFi TVL, and 62% of all L2 fee revenue. The network hit Stage 1 decentralization under the L2BEAT framework: permissionless fault proofs (any user can challenge invalid state transitions via the OP Stack's Fault Proof VM), a 10-member security council requiring 75% consensus for contract upgrades.
The multi-client architecture (op-geth, op-erigon, op-reth running independently) provides genuine fault tolerance: if a bug in one client produces incorrect state transitions, the others catch it. EIP-4844 blob transactions and the subsequent Pectra upgrade (doubling target blob count from 3 to 6) drove the marginal cost of processing an additional Base transaction to essentially zero at current utilization.
The elephant is still the sequencer. Coinbase operates the sole sequencer for Base, which means unilateral transaction ordering power, theoretical MEV extraction capability (even if they don't exercise it), and censorship ability. The move to a "Unified Stack" while remaining an "OP Enterprise customer" could mean Coinbase wants more control over its sequencer roadmap. That might accelerate decentralization. It might entrench their position. The OP Superchain roadmap includes shared sequencer architecture, and Espresso Network is building a decentralized sequencer layer, but no timeline is concrete.
I flagged this in January and it hasn't changed. As long as Coinbase controls transaction ordering on the dominant L2, they have pricing power and capture value. They also have regulatory exposure. If regulators decide a centralized sequencer makes Base look like a securities exchange, that's a problem the fault proof system can't fix.
Where I'm probably wrong
I might be overweighting the BVNK loss. Coinbase walked away from the deal too, which suggests they saw something in due diligence they didn't like or decided the middleware could be built cheaper than bought. Coinbase Business launched in GA in Q4 with payment APIs and stablecoin checkout. If it reaches meaningful volume by late 2026, the BVNK miss becomes a footnote.
I might be too bearish on x402 timelines. If one major AI lab adopts x402 as a default billing protocol for agent API calls, the volume curve goes vertical. The integrations are in place: Stripe, Cloudflare, Google Cloud, World, every major LLM framework via AgentKit. The protocol could become path-dependent (too embedded in the developer ecosystem to displace) before it generates meaningful revenue. That's happened before with infrastructure standards.
And I might be underestimating the compounding effects of Base's dominance. 70% of L2 active addresses is a flywheel: more users attract more developers, more developers build more apps, more apps attract more users. If Base maintains that share through the current crypto downturn, the network effects become very difficult to displace regardless of sequencer centralization concerns.
The biggest risk nobody's talking about is the inverse: Coinbase grew headcount 31% in a year while the crypto market shed $540 billion in value in Q1 2026. They have the balance sheet to sustain it ($11.3 billion in cash). But infrastructure teams building payment rails, compliance systems, and multi-chain settlement have different reliability expectations than exchange teams optimizing for bursty trading volume. Coinbase's exchange has gone down during every major volatility event since 2017. Payment infrastructure customers won't tolerate that. Whether the org has made that cultural shift is something no earnings call can tell you.
What I'm watching
Whether x402 daily volume moves meaningfully after the World/AgentKit integration. If it doesn't budge within 60 days, the demand thesis needs reassessment. If it shows real organic growth (non-gamified, agent-to-API utility payments), this becomes the most important protocol in Coinbase's stack.
Whether Visa keeps routing through BVNK now that Mastercard owns it, or accelerates a build/buy alternative. That dynamic will reshape who controls the stablecoin middleware layer.
How OCC stablecoin rulemaking comments (due May 1) signal bank appetite for white-label stablecoin issuance. If banks want to issue their own stablecoins on Coinbase infrastructure, the platform thesis gets real. If they build in-house, Coinbase loses the middleware play twice.
And the sequencer. Always the sequencer. Coinbase's technical roadmap for Base decentralization will tell you more about their long-term infrastructure ambitions than any revenue number.