MoonPay CEO Demonstrates PayBox: Embedding Wallets in AI Chat Interfaces

Article by: Forbes

Compiled by AididiaoJP, Foresight News

Ivan Soto-Wright, founder and CEO of MoonPay, tried it himself: he had Claude book his flight. After comparing flights, the ticket was booked and payment was made—all without leaving the chat window or opening a separate web checkout page.

The CEO first had Claude book his own flight; next, he wants users' wallets. Soto-Wright told reporters bluntly: PayBox enables agents like Claude and ChatGPT to hold cards and crypto wallets and complete payments, without any single party controlling the private keys.

This is not a demo. It represents the coveted position that payment companies and model providers have been competing for all year—where conversations shift from “giving advice” to “placing orders.” Whoever embeds payments securely into the chat window first will be closest to the next-generation checkout.

Over the past year, Claude and ChatGPT have been able to check flight schedules, compare hotel options, generate shopping lists, and write investment memos. The bottleneck has always been the same: when it comes to payment, users still need to open their browsers, log in to their accounts, and confirm the transaction. OpenAI once experimented with in-chat instant checkout but later scaled back; most products remain at the stage of “I’ve found it for you—now you buy it.”

PayBox fills in this final mile. Launched on July 29, it’s accessible at paybox.sh. Officially positioned as an AI-focused payment vault, it enables agents to transact on the open internet without requiring users to leave their conversation or entrust funds to the AI or platform. Integration is achieved through custom connectors within Claude and ChatGPT. On August 31, Grok was added, with the team stating the integration took only about two days—once standardized connectors are rolled out, scaling on the model side will happen rapidly.

Users can simply give instructions in natural language, such as “Deposit $100 to buy PYUSD,” “Exchange $100 of PYUSD for SOL,” “Bridge funds to Robinhood Chain,” “Maximize yields using Aave,” “Help me book a flight,” or “Reserve a dinner table tonight.” The AI handles research, price comparison, and transaction preparation—funds only move after the user approves with their passkey.

The day after launch, MoonPay claimed that 224,000 people had signed up for paybox.sh, calling it "the fastest-growing product in crypto × AI" and even suggesting it "might have overwhelmed Claude." The figures were self-reported and difficult to verify, but they at least indicate that embedding a wallet into an interface already used by hundreds of millions daily is easier to scale than building a standalone app.

PayBox holds two types of assets that agents need when making actual payments. One is payment cards: agents can initiate payments but cannot view or store the original card numbers; card transactions are processed through Visa’s agent commerce agreement. The other is cryptocurrency wallets: users can create or import wallets, with funds sourced from existing wallets or deposited via card after a one-time identity verification through MoonPay.

The chain launch supports Solana, along with EVM-compatible networks including Ethereum, Hyperliquid, Tempo, Base, Robinhood Chain, Arbitrum, and Polygon. The payment layer integrates x402—the machine payment standard originally open-sourced by Coinbase and now governed by the x402 Foundation under the Linux Foundation. Servers use HTTP 402 to request payment from agents, who settle instantly in stablecoins without needing to open accounts, subscribe, or navigate checkout pages. By the time the foundation becomes fully operational in July 2026, its founding members will include Visa, Mastercard, American Express, Stripe, Shopify, AWS, Google, Circle, and MoonPay itself.

On its launch day, integrated spending scenarios included: booking restaurants via AgentRes.dev, shopping via Purch.xyz, and booking flights via BRIJ.fi. On-chain, users can exchange assets, perform cross-chain transfers, and deposit funds into Aave. On August 27, Solana’s lending protocol Kamino was integrated, enabling eligible users to make deposits to earn yields and borrow USDC using collateral directly within the chat interface. This is not a new lending product—it simply connects Kamino’s existing market into the chat box. The service is currently unavailable in the United States, United Kingdom, European Union, and Australia; asset and jurisdictional restrictions remain in place. These limitations have not been lifted following Grok’s integration.

Permissions are divided into two levels. The first is “Ask Every Time,” requiring a passcode for every transaction. The second is “Autonomous Mode,” where the AI can only act within the limits and rules set by the user. Changing permissions requires re-approval by the user, and authorization can be revoked at any time. The company repeatedly emphasizes one rule: AI can research, compare prices, and create proposals all day, but funds will only move according to the user’s rules.

The biggest fears in agency payments are: a stolen credential that can be used anywhere, a card number that can be repeatedly drained once leaked, and a single-point system that, once compromised, allows all funds to be transferred.

PayBox's solution is highly specific: the wallet key is split using threshold cryptography and stored in a hardware-isolated Trusted Execution Environment (TEE). No single party—MoonPay, an AI agent, or the user’s phone—can reconstruct the full private key or sign a transaction alone. Even if the phone is compromised, the missing key shards are not stored anywhere nearby. Each approval for a passkey is valid for only a single action and expires immediately after use; intercepted approvals cannot be replayed or escalated to grant broader permissions.

This infrastructure comes from Sodot, an Israeli key management company that MoonPay acquired entirely for stock in April for approximately $100 million. Sodot claims to safeguard over $50 billion in assets and more than 10 million wallets for crypto companies. Combined with MoonPay’s platform, which serves over 1,700 enterprise clients, it forms the underlying infrastructure behind each vault.

The official summary of this design is “autonomous but not custodial.” Existing products often force users to choose: if you want an agent to place orders on your behalf, you must entrust your funds to the platform, agent, or custodial wallet. PayBox’s design ensures that no party—including MoonPay or AI—can unilaterally access funds or credentials. There are no endpoints, no custodial handoffs, and no closed ecosystems.

This is certainly not risk-free. Prompt injection, phishing conversations, and supply chain attacks could all trick users into approving transactions within their limits. The vault can protect against having the entire key stolen, but it can’t stop someone from being manipulated by persuasive language into clicking “confirm.” The autonomous mode moves approval upstream—convenience and risk are two sides of the same coin.

PayBox didn’t appear out of nowhere. In March 2026, the company launched an open wallet standard for AI agents, backed by PayPal, the Ethereum Foundation, and the Solana Foundation. In May, users could buy crypto directly within ChatGPT, though they still had to be redirected to a checkout page. In June, the desktop app MoonAgents integrated Claude Code and Codex directly with wallets, exchanges, and prediction markets. That same month, PayBox acquired Entendre, a startup specializing in AI accounting agents, bringing reconciliation, treasury management, and closing processes for stablecoin payments under its umbrella. Meanwhile, infrastructure for enterprise-grade stablecoins and Mastercard virtual cards designed for AI agents to spend stablecoins were also in development.

On July 29, PayBox launched support for Claude and ChatGPT. In August, it integrated Cash App for deposits and connected Kamino to the treasury. On August 31, it expanded to Grok. The roadmap is clear: start with deposits, then enable trading within conversations, followed by integrating lending and yield, and finally extend the same treasury infrastructure to more assistants.

The company is also substantial in scale. Founded in 2019, it serves over 30 million users across 180 countries and has more than 1,700 enterprise clients, offering services spanning deposits and withdrawals, trading, commerce, and stablecoin infrastructure. It holds licenses including the New York BitLicense, New York Limited Purpose Trust Charter, multiple U.S. state money transmitter licenses, and authorization under the EU’s MiCA regulation. Former CFTC Acting Chair Caroline Pham has joined as Chief Legal and Administrative Officer. Regulatory narrative and product narrative are intertwined: once agents can hold cards and coins, compliance must keep pace.

In the summer of 2026, agent payments moved from PowerPoint to live deployment. Card networks launched licensed networks: Visa introduced the Trusted Agent Protocol and intelligent commerce, while Mastercard rolled out Agent Pay for Machines, replacing bare card numbers with tokenized credentials. Model providers entered the checkout layer: OpenAI and Stripe jointly open-sourced the Agentic Commerce Protocol, handling the shopping cart tier. Google’s AP2 manages authorization and intent proof. Coinbase delivered x402, enabling “one HTTP request, one checkout,” with settlements typically in stablecoins.

These protocols don’t completely conflict; rather, they operate on different layers. x402 handles machine-side, micropayments on a per-transaction basis; ACP manages consumer checkout; and AP2 verifies “whether this payment was authorized by the rightful owner.” Gartner provided a figure that large corporations often use for budgeting: by 2028, agent-initiated B2B procurement could reach $15 trillion. On the other hand, independent analyses have offered a reality check—while the cumulative transaction volume of x402 on Base appears substantial, the actual daily active transaction value may be far lower than advertised, with a significant portion consisting of self-trades and inflated activity.

MoonPay has chosen a strategic position: it doesn’t build its own closed marketplace, nor does it simply serve as a checkout button for a single model; instead, it acts as a non-custodial vault that can be integrated with multiple assistants, connecting both card and blockchain rails. The quote by Soto-Wright, repeatedly cited by media outlets across the board, has essentially become the rallying cry of the entire narrative:

Card hid the cash, phone hid the card. Now we’ve reached the era where money disappears into conversations. Billions of AI agents are coming online, each needing to securely hold, transfer, and spend funds. Someone had to build a layer of trust for this world. We just did. PayBox is the product MoonPay was born to create.

The reason booking a flight is featured in the headline is because it’s something everyday—users can easily grasp “have Claude book the ticket,” which feels more tangible than “have an agent maximize yields on Aave.” But what the product truly aims to unlock is the latter set of actions: swapping tokens, cross-chain transfers, entering lending pools, paying merchants, and automatically executing trades within limits.

Current penetration remains low. Features like Kamino are unavailable in major jurisdictions, Grok requires users to add connectors themselves, the extent of autonomous mode depends entirely on individual risk management, and the real commercial scale of x402 still doesn’t match the grand narrative. But the direction is now irreversible. Assistants are no longer just being asked, “Which flight is cheaper?”—they’re being told, “Buy it for me.”

The CEO previously purchased a ticket. The product is now open to Claude, ChatGPT, and Grok. The remaining questions are specific: when the chat interface begins to interact with wallets, will users be willing to grant approval rights; and can this “no single person holds the key” design maintain the delicate balance between convenience and control under real-world traffic?