The x402 directory has a whale

Blockrun.ai is the top-ranked provider in the main x402 directory — the place where x402 endpoints register and publish their payment stats. On Sep 16, the directory reported it had settled $45,999.88 over the trailing 30 days: 3,464,562 payment transactions from 438 buyers. A day later, the same panel read $31,704.26 and 2,249,029 transactions — a 31% drop in 24 hours.

We went to the chain and looked at who was actually paying. One wallet — 0x2b4ee3387008e5ff1a9996fc8b48d2fd61389037 — accounts for 97.6% of the value in our measurement. The other 388 wallets combined paid $739.35. And it turns out the whale had been running for at least a week before our window opened: our 30-day scan caught the end of a campaign that had been running for at least a month, with the whale already at full volume on the first day we can see it. Here's the full picture, with the data.

The data

We pulled every USDC Transfer into blockrun's payment wallet (0xe9030014F5DAe217d0A152f02A043567b16c1aBf) over a 30-day window ending when we pulled the data (Aug 18 12:42 UTC → Sep 17 12:35 UTC, 2026): 2,154,129 settlements, $30,882.24, 389 distinct payer wallets, zero unrecovered chunks — every block range in the window (30-minute chunks, 1-hour chunks for the most recent days, two-pass retry) was read from Base mainnet and reconciled.

Terminology, because it matters here: a settlement is one USDC Transfer log into blockrun's wallet. That log is the unit of count, and its amount is the unit of dollars. x402 settlement on Base is facilitator-mediated — the buyer authorizes the payment with an EIP-3009 transfer-with-authorization signature, a facilitator wallet submits the transaction — so "who paid" exists only in the transfer log (the sender topic), never in the transaction itself. Outflows from a wallet are its USDC transfers to any destination.

Our numbers run ~3% below the directory's for the same period. We can see neither the directory's window edges nor its counter, so we can't close that gap exactly; the shape of the data is not in doubt. Worth knowing: the directory itself lists blockrun's first on-chain settlement as Jan 1, 2026 and its all-time volume as $486,935. The 30-day panel is not the whole market — it's one burst inside a months-long history, and the burst we measured is the one currently dominating it.

One wallet: 97.6%. The whale sent 2,125,041 of the 2,154,129 settlements — $30,142.89, at an average of $0.0142 per payment. The rest: 388 wallets, $739.35, an average of $1.90 per wallet for the whole month. The second-largest payer: $75.96.

The shape of the money

The whale's first settlement in our window: Aug 18, 12:42 UTC. Its last: Sep 11, 02:56 UTC. Daily totals inside the window (all 31 days, $):

08-18   $    4,880
08-19   $    9,039   <- peak in window
08-20   $    6,139
08-21   $    4,120
08-22   $      636
08-23   $      863
08-24   $       41
08-25   $       89
08-26   $       51
08-27   $       24
08-28   $       67
08-29   $       23
08-30   $       19
08-31   $       15
09-01   $       10
09-02   $    2,036
09-03   $       32
09-04   $       25
09-05   $       23
09-06   $        6
09-07   $       31
09-08   $       10
09-09   $       20
09-10   $       17
09-11   $    2,456
09-12   $       18
09-13   $       45
09-14   $       53
09-15   $       63
09-16   $       21
09-17   $       11

Read that as a lifecycle inside the window: a sustained four-day run (about 1.8M settlements — one payment every 0.17 seconds at the peak day's pace), a taper to background, two final bursts (Sep 2 and Sep 11 — the last at ~$0.44 per payment instead of $0.014, different endpoints or bigger batches), then silence. The long tail kept paying $10–90 a day the whole time.

But the window was not the start. A separate scan, chunked the same way and going back day by day, found the whale already paying blockrun at full volume before Aug 18: $5,052 (Aug 11, partial day), $13,724 (Aug 12), $8,129 (Aug 13), $8,586 (Aug 14), $10,279 (Aug 15), $6,826 (Aug 16), $15,664 (Aug 17 — the highest day of the whole campaign, 1.2M payments), and $8,708 in the half-day before our window opened. Every USDC outflow we attributed to the whale in both scans — pre-window and in-window — went to one address: blockrun's payment wallet. Those pre-window days total about $77,000 in whale payments — more than double everything inside the 30-day window. The panel the directory publishes was showing us the tail of a much larger run.

On the peak day the concentration was absolute. In a chunk-by-chunk recount of Aug 19 — every block range of the day read clean — the whale sent 508,020 of the day's 508,565 settlements: 99.9%, and every counted USDC outflow from the whale that day went to blockrun's wallet (one distinct recipient, all 508,020). One destination, all day.

What moved the directory's number

Between the Sep 16 and Sep 17 pulls, the directory's 30-day total fell $14,295.62 while the service ran unchanged. The mechanism, now that we've measured the slide-out day: the window's oldest day — Aug 17, on which the whale alone settled $15,664 — rolled out, and a near-silent day (Sep 17: $11 in our count) rolled in. The arithmetic doesn't match to the dollar — the directory's window anchoring and counter aren't published — but nothing else on the scale of the drop is moving. A single bursty consumer can move a "market" metric by a third overnight, with the service running exactly as normal.

So who is the whale?

What we can say from the chain:

• It's a plain EOA — no ENS, no identity layer, dust balances (0.0001 ETH, 0.00005 USDC as of Sep 17).
• It didn't appear out of nowhere. The wallet shows Base activity from at least mid-June, mostly as a repeated dust-transfer relay with a companion wallet (0xe90383d2DA6d69e46584478590E2306bA9151abf) — which shares the 0xe903 prefix with blockrun's own payment wallet.
• The companion wallet, in turn, gets dust pings from a third party: a contract (0x721BC1633350F86Fd88b9e2cDE1688A20929bdDd) still active as we write this. In its most recent ~300 pings (~2 hours at the observed ~2.5 pings per minute), it contacted 137 distinct wallets with ~0.16-gwei transfers.

That's consistent with a fan-out dispatcher — a job-signaling network of wallets, the whale as one member, the companion as its relay, blockrun's volume as the current workload. Note what it is not proof of: the whale and the companion are both absent from the current ping sample, and a two-hour window of a rotating target list can't rule out shared infrastructure. What we can say is narrower but solid: the structure is consistent with one operator's fleet, and we found no evidence the other big payers belong to it.

What we can't say: whose wallet it is. A customer's production pipeline, a data vendor scraping blockrun's catalog, an eval campaign, a cost-shedding relay for a bigger system, or — we can't rule it out — blockrun's own operator generating volume through a router. The multi-wallet architecture and the months-old history argue against a one-off test; the unlabeled address argues against certainty. The directory marks blockrun "degraded" and unverified. We're marking the whale unidentified.

How to read x402 stats after this

Three habits, all cheap:

1. Concentration before totals. One query gets you per-payer shares. 97.6% in one wallet changes what a "$31K month" means.
2. Look at the daily shape. A bursty profile is a workload, not a customer base. A flat profile with many small wallets is the thing everyone's hoping for.
3. Find the steady state. Subtract the whale and blockrun's baseline is 388 wallets paying ~$739/month. It includes one wallet active every single day of the window (5,400 payments, $40.34 — about $1.30 a day, almost certainly automation). Small. Honest. The number to build on.

None of this means the x402 market is fake. It means it's early, and at this stage a directory's top line is really a single consumer's run history — and the chain tells you which one, if you ask.

Reproduce it

The full dataset — all 389 payers with totals, active-day counts, first/last activity, and the daily series — is a dated snapshot: GET /blockrun-whale on api.pennyforge.org, CC BY 4.0. Method, exact window block ranges, and caveats are in the file; the whale's full address is in the data. The scan scripts are available on request.

Pennyforge is a one-person studio running a small paid x402 API, listed in the same directory we're reading. Disclosure, plainly: we're not blockrun, we don't know the whale, and the same fragility applies to our own row — our listing's 30-day settlements are $0.14: one marketplace-canary call, four paid calls from a conformance auditor we know by name, three from stranger wallets, two of our own simulation calls, and a few sub-cent dust pings. Our data, on-chain or otherwise, is yours to check.

Update — Sep 20: the whale is quiet

The scan above already marked the whale's last settlement: Sep 11, 02:56 UTC. Nine days on, we re-checked.

• Its silence is confirmed on-chain. We pulled the 2,499 most recent USDC settlements into blockrun's payment wallet — covering Sep 17, 15:22 UTC through Sep 20, 07:38 UTC — and none of them is from the whale. Every one is from the long tail of small buyers.
• The whale wallet itself is dormant. USDC balance still 0.000051, unchanged; no new token transfers; same dust of meme coins it has carried since June.
• The directory's panel kept sliding as the whale's August days rolled out of the 30-day window: blockrun's published 30-day figure is now $10,569.77 from 439 buyers (it read $45,999.88 on Sep 16). The service itself is unscathed — its wallet still receives roughly 56 small payments an hour.

So the lifecycle is now fully visible: at least Aug 11 → Sep 11, about $107,000 and 2.13 million settlements, then nine days of silence. It reads like a job with a deadline — a catalog to exhaust, a dataset to fill — not a customer base. The market-shape lesson above stands, and it got sharper: the "30-day market" was the whale's run history plus a tail of ~$740 a month, and the whale's share has now left the panel entirely.