Revised October 2026. First published May 2026. Product facts updated to match the live protocol; the argument is unchanged. Reference: https://docs.hashlock.markets
Ask a trading agent what it holds and it will give you a clean answer: Bitcoin, dollars, some treasuries. Then read the actual wallet. What you find is a wrapped token, a bridged stablecoin, a tokenized note. None of those things are the asset. Each one is a promise that the asset exists somewhere else, in someone else's custody, and that the someone will honor the claim when asked.
That gap, between what an agent reports holding and what it actually holds, is small enough to ignore right up until it isn't. It is worth looking at directly.
What a wrapper actually is
Take wrapped Bitcoin, the most familiar case. Bitcoin the chain cannot run the contract logic that most trading venues need, so to "use BTC" somewhere else you wrap it: you hand the real Bitcoin to a custodian, and the custodian mints a token on the destination chain that represents a claim on it. The token moves and trades freely. The real coins sit still, in the custodian's keys.
This is convenient, and it is everywhere. It is also a quiet swap of one kind of thing for another. Native Bitcoin is a bearer asset: holding the key is ownership, with no one else in the loop. A wrapped token is a claim against an intermediary. The token is worth what the asset is worth only as long as the institution behind it stays solvent, stays honest, and stays in business. The moment that stops being true, the token is worth whatever the market thinks the recovery will be.
And it is not only Bitcoin. Bridged stablecoins are claims on a bridge's reserve. Tokenized treasuries are claims on an issuer's brokerage account. Liquid staking tokens are claims on a validator set. Walk through a working trading agent's inventory and a striking share of it is not assets; it is IOUs, each one as good as the institution standing behind it.
Why this is worse for an agent than for a human
A human trader holds wrapped and tokenized assets too, and mostly does fine. The reason is that a human is quietly running a trust model the whole time. You know which custodians have been around, which had a bad year, which name keeps coming up in the wrong kind of news. You read a depeg as it starts. You can decide, on a hunch, to move early.
An autonomous agent has none of that. It has no instinct for a brand, no memory of last cycle's blowups, no feel for when a quiet story is about to get loud. It cannot open a custodian's books and verify solvency. It cannot confirm that the locked backing pile is whole and unencumbered. What it can do is read a token balance and a price, and those two numbers look identical whether the backing is pristine or already gone.
So an agent holding wrapped assets is holding unverifiable trust: trust it did not evaluate, because it has no way to evaluate it. Multiply that across a fleet of agents transacting continuously, with no human in the loop on any single position, and the wrapper stops being a convenience and starts being the largest unpriced risk in the system.
There is a second-order problem too. Every wrapped asset has a backing pile: the real coins or reserves held in one place. That pile is a single, standing, valuable target. The more agent capital flows into wrapped form, the bigger and more attractive the honeypot, and the more an individual agent's safety depends on infrastructure it cannot see.
The fix is not a better custodian
The instinct is to ask for a more trustworthy wrapper: better attestations, more frequent proof-of-reserves, a more reputable name. That helps a human, because a human can weigh reputation. It does not close the gap for an agent, because the agent still cannot verify any of it; it can only be told, and being told is not the same as knowing.
The structural fix is different. It is settlement that never converts the asset into someone's liability in the first place.
Concretely: the asset stays native on its own chain. Bitcoin stays as Bitcoin, locked in a hash-time-locked script on the Bitcoin chain itself, not handed to anyone, not represented by a minted token. What crosses between chains is not the asset and not custody of it. It is a single piece of information: the sha256 hash of a secret. The other leg of the trade lives on the counterparty's chain; the asset lives where it already is; the two are coupled only by that shared hash, and resolved by revealing the preimage or by a timeout. No custodian ever holds the unilateral ability to move the coins.
This is the design behind every Hashlock swap, and it generalizes: settle with assets in their native, bearer form, and move information across chains instead of moving custody. An agent does not have to audit a custodian if there is no custodian in the path.
For an autonomous agent, this should not be hand-managed plumbing. Watching a locked output, coordinating timeouts across chains with very different block times, building the right spend path: that belongs behind a tool call. Our MCP server (@hashlock-tech/mcp on npm, hosted at https://hashlock.markets/mcp) exists so an agent reasons about the position rather than the script-level mechanics. MCP is the open protocol Anthropic introduced for connecting models to external systems.
The honest status
This is a direction, and it deserves a straight status report rather than a confident one. The protocol is live on mainnet across six chains today: Bitcoin, Ethereum, TRON, Solana, Base, and Robinhood Chain, with native Bitcoin locked in its own P2WSH script on the Bitcoin chain. The tradeoffs are real: funds sit locked for the life of a leg (24 hours on Bitcoin, 4 hours on the other chains), and Bitcoin's roughly ten-minute blocks make timeout windows coarse. Removing the custodian is not free. We think it is worth the price for the assets an agent is meant to hold for real.
The question
Wrapped assets made everything usable everywhere by making everything custodial everywhere. For a human running a trust model in the background, that trade is often fine. For an autonomous agent that cannot run that model, it is an open question whether it should ever hold a custodial asset at all.
So here is the question for anyone building trading agents: do you actually know what your agent owns right now, the asset, or a promise of the asset? And if it is a promise, who is on the other side of it, and what happens to your agent the day that promise is tested?
Hashlock Markets: atomic settlement for the agent economy. Sealed-bid RFQ + HTLC settlement, fused into one operation. No bridges, no custodians.
- Protocol: https://hashlock.markets?utm_source=devto&utm_medium=referral&utm_campaign=2026-05-26-agent-holds-iou
- MCP server (source): https://github.com/Hashlock-Tech/hashlock-mcp
- The underlying mechanism design is written up in a working paper on SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6712722
Top comments (0)