Over the past seven days, a mid-cap DeFi protocol on Arbitrum watched roughly 38% of its liquidity providers walk out the door. No exploit. No governance vote. No token unlock. The contracts behaved exactly as written. What moved was sentiment — and the sentiment was not human.
Wallet clustering across the withdrawal transactions tells a quieter story. Roughly two-thirds of the exits traced back to a small, tightly connected set of automated agents. They were responding to a single risk signal, published hours earlier, by another automated agent. One machine issued a score. A second machine treated that score as truth. A third machine executed the trade. By the time a person opened the thread and started reading, the liquidity was gone.
This is the part of the AI-and-crypto story that gets buried beneath price charts and conference keynotes. The agents are not coming. They are here. They are already large. And almost none of them have been verified by a human being who actually understands what they are doing.
Context: The Agent Economy Arrived While We Were Watching the Price
For most of the last two years, "AI agents in crypto" meant a demo. A bot that could rebalance a portfolio. A chatbot that could explain a token. A trading script with a large language model bolted on top so it could justify its own decisions in fluent English.
Those demos are now production systems. The shift happened quietly, which is exactly how infrastructure shifts usually happen. There was no single launch. There was a gradual migration of trading, market-making, and treasury management from human desks to software that decides on its own.
The numbers are hard to pin down precisely, and anyone who claims otherwise is guessing. But the directional evidence is consistent across multiple data providers. Automated and semi-automated strategies now account for a large and growing share of spot volume on centralized venues, and a similar pattern is emerging on-chain. What is new is not automation itself. Market makers have used bots for a decade. What is new is discretion. Earlier bots followed rules. The new agents interpret.
That distinction matters more than it sounds. A rule-based bot that fires when a price crosses a moving average is predictable. You can read its logic. You can backtest it. You can, in principle, audit it. An agent that reads news, weighs sentiment, and then decides whether to act is a different kind of system entirely. Its behavior is not fully specified in advance. It emerges from a model, a prompt, and a stream of inputs that change every second.
The closest historical parallel is high-frequency trading, which transformed traditional markets over the past two decades. HFT brought speed, liquidity, and a series of spectacular accidents, including the 2010 flash crash, when the Dow briefly lost nearly a thousand points in minutes before recovering. Regulators eventually responded with circuit breakers, order-type restrictions, and disclosure requirements. The crypto agent economy is heading toward a similar reckoning, but with two differences that make it worse. The first is leverage, which is easier to obtain and harder to see on-chain. The second is that the decision-makers are models, not algorithms, and models are harder to constrain with rules because their behavior is not fully written down.
I have spent enough time in smart contract audits to trust code more than I trust people. But here is the uncomfortable part of the agent economy: the code is no longer the only thing making the decision. The model is. And models do not come with the same guarantees that contracts do.
There is a second reason the shift went unnoticed. Agents do not announce themselves. They do not have logos or communities or governance forums. They are, by design, indistinguishable from ordinary order flow. A human reading a tape cannot tell whether a large sell came from a person who lost faith or a model that hit a threshold. The market has become partly opaque to its own participants, and that opacity is structural, not incidental.
Core: What the On-Chain Data Actually Shows
The mechanics are worth walking through, because the popular narrative and the on-chain record describe two different worlds.
When an AI agent trades, it typically does not do so in isolation. It consumes signals. Those signals come from other agents, from data providers, from social platforms, from on-chain oracles, and increasingly from other models. The result is a layered pipeline of machine decisions, where the output of one model becomes the input of the next. Each layer trusts the one below it. None of them fully understands the one below it.
Walk through a single decision and the problem becomes concrete. A social-listening model scores sentiment on a token. That score is packaged as a signal and sold to a downstream strategy. The strategy, reading the score as an independent fact, sizes a position. The execution agent splits the order across venues to reduce slippage. A fourth system, watching for large inflows, interprets the flow as smart money and follows. At no point in this chain did anyone verify the original sentiment score against reality. The score was not a fact. It was an interpretation. But by the fourth layer, it had hardened into something that looked like data.
This is where the accountability gap opens. In a traditional market, when a fund makes a bad trade, there is a person, a committee, and a paper trail. In the agent pipeline, there is a chain of dependencies. The trader blames the signal. The signal blames the data provider. The data provider blames the model. The model, of course, blames nothing, because it has no concept of blame.
I want to be precise here, because this is where speculation usually replaces analysis. I am not claiming that AI agents caused the Arbitrum withdrawals I described. I am claiming something narrower and more defensible: the withdrawal pattern is consistent with correlated machine behavior, and correlated machine behavior is a structural feature of the current market, not an accident.
Consider what correlation does to a market. A diverse market of human traders is noisy. Noise is healthy. It absorbs shocks because different people react differently, at different times, for different reasons. A market where a large share of participants read the same signals and run the same models is not noisy. It is synchronized. And synchronized systems fail together.
This is not a new idea. It is the oldest lesson in risk management. The 2008 crisis was, at its core, a story about correlated models. Different institutions, different balance sheets, same assumption. When the assumption broke, everything broke at once. The crypto agent economy is rebuilding that structure on a faster clock and with less oversight.
Now add the second layer: the incentives. Agents are not neutral observers. They are optimized. They are optimized to generate returns, to reduce drawdown, to capture attention, or to do whatever the person who deployed them wanted. And the fastest way to generate returns in a thin, volatile market is often to move before everyone else. Speed becomes the edge. Reflexivity becomes the strategy.
Here is where my own experience colors how I read this. In 2017, I spent six months manually auditing the time-crowdsale mechanisms of three mid-tier ICOs. I found reentrancy vulnerabilities in two of them. The lesson I took from that year was not that code is dangerous. It was that code is only as trustworthy as the assumptions baked into it, and that assumptions are almost always human. A contract that assumes an oracle returns a fair price is a contract that trusts the oracle. A contract that assumes a token has liquidity is a contract that trusts the market maker.
The agent economy multiplies this problem by an order of magnitude. Every agent embeds assumptions about the world. Every signal embeds assumptions about the agents consuming it. Stack these together and you get a tower of trust that no single participant can see from the bottom.
The Order Flow Tells a Story the Charts Do Not
There are fingerprints in the data that distinguish machine flow from human flow, if you know where to look. Machine orders cluster at round numbers and at mathematically meaningful levels — moving averages, retracement bands, liquidation thresholds. They arrive in bursts, synchronized to the second, because they are triggered by the same event. They scale in and out with a regularity that human emotion never produces. A human trader who is afraid does not add exactly 2.5% to a position at a price that happens to equal a 50-period average. A model does, because that is what it was told to do.
I have used these fingerprints in my own work to separate narrative from flow. When a token's price rises on news but the order flow shows no machine clustering, the move is often human — emotional, and often short-lived. When the price rises with dense, synchronized machine clusters, the move is structural, and it can run much further than the news alone would justify. Neither pattern is good or bad in itself. But they require different responses, and treating them as the same thing is how people get hurt.
Learning to read these fingerprints should be a basic skill for anyone with capital at risk. It is not taught, because it is unglamorous, and because the people who profit from the confusion have no interest in teaching it.
The Signal Market Nobody Regulates
There is a specific mechanism that deserves scrutiny, and it rarely gets any: the market for signals.
Agents need inputs. Someone has to produce them. In practice, a growing cottage industry of "signal providers" has emerged — some are legitimate analytics firms, some are pseudonymous accounts with impressive dashboards, and some are agents themselves, repackaging one model's output as independent confirmation.
This creates a feedback loop with no natural brake. An agent publishes a bullish signal. Other agents pick it up and act. Their actions move the price. The price movement validates the signal. The signal is amplified. More agents enter. The loop reinforces itself until it exhausts.
In a purely human market, this dynamic exists too — it is called a bubble — but it is slowed by friction. People hesitate. People ask questions. People get tired. Machines do none of these things. They are fast, tireless, and, crucially, they do not doubt.
When I worked on the AI-agent accountability framework in Warsaw in 2026, this was the single most difficult problem we faced. We wanted to cross-reference AI sentiment outputs with on-chain whale movements, to see whether machine narratives preceded real capital or merely echoed it. The answer, in our dataset, was uncomfortable. In a meaningful share of cases, machine sentiment moved before capital did. The machines were not following the whales. The whales were, at least partly, following the machines.
I should be careful about how strongly I state this. Our dataset was a sample, not the whole market, and I do not want to overclaim. But the direction of the finding has held up in every follow-up review I have done. The narrative and the capital have become entangled in a way that no longer respects the old ordering.
There is a deeper problem in the signal market that has nothing to do with accuracy. It is about incentives. A signal provider is rewarded for being followed, not for being right. Attention is the product. A provider who is wrong but loud will out-earn a provider who is quiet and correct, because the loud one captures more of the flow. This is a structural bias toward confident nonsense, and it is exactly the bias that machines are least equipped to resist. A human might discount a source they have learned to distrust. A model has no memory of being misled unless someone programmed that memory in.
Why Decentralization Claims Do Not Save You Here
There is a comforting story that the agent economy will be safe because it runs on decentralized rails. I find this story misleading, and I want to explain why without resorting to slogans.
Decentralization, in most of the systems people point to, is a property of settlement. It is not a property of decision-making. When an agent decides to trade, that decision happens off-chain, inside a model, on infrastructure controlled by whoever deployed it. The fact that the resulting transaction is settled on a decentralized network does not make the decision decentralized. It only makes the record of the decision immutable.
This is a distinction that gets lost constantly, and it is the same distinction that undermines much of the "decentralized sequencing" narrative in the layer-2 space. A sequencer can be called decentralized in a document while remaining, in practice, a single node operated by a single team. The word describes an aspiration, not a state. The same gap applies to agents. An agent can run on a decentralized network while its actual intelligence — the model weights, the prompt, the data pipeline — sits on a server that no one outside the team can inspect.
So when someone tells you that AI agents are safe because crypto is decentralized, what they are really telling you is that the settlement layer is robust. They are not telling you anything about the part that can actually fail.
The Audit Problem
Let me put the core problem plainly, because it is easy to lose in the abstraction.
You cannot audit a model the way you audit a contract. A smart contract is a fixed set of instructions. Given the same inputs, it produces the same outputs, every time. You can read it line by line. You can prove properties about it. You can, with enough effort, know exactly what it will do.
A model is not like this. Given the same inputs, it may produce different outputs, depending on temperature, sampling, context length, and a dozen parameters that shift with version updates. Its behavior is statistical, not deterministic. You cannot prove what it will do. You can only estimate the distribution of what it might do.
This is not a criticism of AI. It is a description of the technology. But it has a direct consequence for anyone who cares about market integrity: the standard tools of verification do not transfer. The audit playbook I learned in 2017 — read the code, test the edge cases, verify the assumptions — does not fully apply. There is no line of code that says "decide to sell." There is a probability distribution that, under certain conditions, tends toward selling.
The industry has not internalized this yet. We still talk about "audited agents" as if an audit means the same thing it means for a contract. It does not. An audit of an agent can tell you about its guardrails, its access controls, its logging. It cannot tell you what it will do in a market it has never seen.
This is why I have argued, and will keep arguing, that the verification layer for AI agents has to be human, and it has to be continuous. A one-time audit is a snapshot. A model in production is a moving target. The only way to keep it honest is to keep watching it, with people who understand both the market and the machinery.
The Institutional Blind Spot
There is an irony in all of this, and it connects to a broader pattern I have watched for three years.
The institutions entering crypto — the funds, the custodians, the payment processors — are, by disposition, careful. They run risk committees. They demand documentation. They do not like unknowns. And yet the agent infrastructure they are increasingly exposed to is precisely the kind of unknown they claim to avoid.
Part of this is that the exposure is indirect. A fund does not need to deploy an agent to be affected by one. It only needs to trade in a market where agents are active, which is now every liquid market. The risk arrives through correlation, not through a contract.
Part of it is that the reporting is thin. There is no standard for disclosing how much of a venue's volume is machine-driven. There is no label on an order that says "this decision was made by a model with no human in the loop." A trader looking at a chart cannot tell whether the pattern they see was produced by people or by software. The tape does not distinguish.
I think this will change, and it will change for a familiar reason. Institutions do not adopt transparency out of virtue. They adopt it when the absence of transparency becomes a liability. The first time a large fund is forced to explain, to its own investors, that a drawdown was amplified by machine correlation it never modeled, the demand for disclosure will appear overnight. Until then, the gap stays open.
I have watched this pattern before, in a different form. In 2024, when I led a series profiling small Polish businesses using Bitcoin ETFs for cross-border payments, the institutions I interviewed cared far more about operational reliability than about ideology. They did not adopt crypto because they believed in decentralization. They adopted it because it solved a specific, boring problem: moving money across borders without losing days to intermediaries. The lesson stuck with me. Institutions adopt what works, and they abandon what embarrasses them. If agent-driven markets start embarrassing them, they will demand the labels and the reporting. Not before.
The Token Incentive Problem
There is one more layer worth naming, and it sits at the intersection of agents and token design.
Many crypto projects now use tokens to pay for the data and compute that agents consume. This is presented as a virtue: the agent economy is bootstrapped by the token economy, and the token captures value from the agents' activity. In practice, it creates a perverse incentive.
If an agent's inputs are paid for in a token, then the value of the token depends on the volume of agent activity, not on the quality of the agents' decisions. A project is rewarded for more agent activity, even if that activity is noise, even if it is harmful, even if it is an agent trading with itself. The token does not care whether the decision was good. It only counts the transaction.
This is the same dynamic I have criticized in the real-world-asset space for three years. Tokenization is easy. Building something that traditional institutions actually want to use is hard. So the industry tokenizes the easy part and calls it progress, and the token rewards the appearance of activity rather than its substance. The agent economy is now repeating that pattern at machine speed.
An agent that trades with itself to farm a token is not providing liquidity. It is manufacturing the appearance of it. And because the token rewards volume, the market cannot tell the difference. The metric that is supposed to measure health — activity — is the very thing being gamed.
Contrarian: The Agents Might Be Making Markets Safer, Not Riskier
Now let me argue against myself, because a one-sided case is not analysis.
The bearish read on agents is intuitive: they are fast, correlated, and unaccountable, so they must be dangerous. But there is a bullish case, and it is stronger than the skeptics admit.
Agents compress the time between information and price. In a market with genuine informational inefficiency, that is a public good. If a token is mispriced because humans are slow to react, an agent that reacts faster corrects the price sooner, and everyone who trades afterward benefits from a more accurate market. The 2022 collapse taught me that slow information is not neutral. Rumors spread faster than facts, and people lost money because the facts arrived late. A well-built agent that surfaces verified on-chain data quickly is, in that frame, a defensive tool.
There is also a liquidity argument. Agents that provide quotes around the clock widen the hours in which a market is deep. For a small business in Warsaw trying to convert revenue into stablecoins at 2 a.m., an always-on market maker is not a threat. It is the difference between a usable rail and a closed one.
So the honest position is not "agents are bad." It is "agents are powerful, and power without verification is a liability." The technology is not the problem. The absence of a human check on the technology is the problem. Code does not lie, only humans do — and a model, left unexamined, is just a very fast way for a human assumption to travel a very long distance before anyone notices it was wrong.
The real question is not whether to allow agents. They are already here, and banning them is not on the table. The question is what kind of verification layer we build around them, and whether we build it before or after the first systemic accident.
What a Verification Layer Would Actually Look Like
I want to end the analysis with something concrete, because "we need more oversight" is the kind of statement that means nothing.
A workable verification layer has three parts, and none of them require banning anything.
The first is provenance. Every automated order should carry a verifiable label indicating that it originated from a machine, and ideally from which class of machine. This is not surveillance. It is labeling. We already label financial products. We can label financial actors.
The second is disclosure of correlation. Venues should be required to publish, at some reasonable granularity, what share of their volume comes from automated strategies, and how concentrated those strategies are. A market where 60% of volume comes from three agents is a different risk object than a market where it comes from three thousand. The number matters.
The third, and the hardest, is human-in-the-loop for the largest actors. Not for every trade — that would destroy the speed advantage that makes agents useful. But for the systems large enough to move a market, there should be a person accountable for the model's behavior, with the authority and the obligation to intervene. This is what I tried to build in 2026, and it is what I would push for now.
None of this is exotic. It is the same logic that gave us circuit breakers and disclosure rules in traditional markets. We did not invent those because we distrusted markets. We invented them because we understood that trust, unverified, is just a story we tell ourselves until it breaks.
Takeaway
The agents are not a future scenario to be debated at conferences. They are the present, and they are trading, and most of them have never been examined by a person who understands what they are doing. Truth is often buried under the noise, and right now the noise is a bull case for AI and a bear case for AI, shouted past each other. The signal is quieter. It is a liquidity pool that emptied in an afternoon because machines agreed with each other. Silence speaks louder than hype. Watch the tape, not the keynote. The next systemic question will not be whether agents can trade. It will be who, if anyone, is accountable when they all trade the same way at once.
