MoonPay launches PayBox to execute crypto and card payments inside Claude and ChatGPT
The non-custodial MPC design supports Solana plus seven EVM chains and adds an “Autonomous” spend mode ahead of an Aug. 2 EU oversight deadline.
MoonPay launched PayBox on July 29, 2026, letting Claude and ChatGPT users initiate crypto transfers and tokenized card payments without leaving the conversation. The product’s security pitch is non-custodial MPC key-splitting across TEEs, but its biggest practical risk shifts to what the AI is allowed to do in “Autonomous” mode.
Key Takeaways
- MoonPay’s PayBox went live on July 29, 2026, enabling crypto and card payments to be initiated from inside Claude and ChatGPT chats.
- The launch version supports Solana and seven EVM-compatible chains: Ethereum, Hyperliquid, Tempo, Base, Robinhood Chain, Arbitrum, and Polygon.
- Users can choose between “Always Ask” passkey approval per transaction or “Autonomous” spending within user-defined limits.
- Card payments run through Visa’s agentic commerce tokenization so the agent never sees the raw card number, and the implementation is described as audited by Trail of Bits and NCC Group and meeting PCI DSS standards.
PayBox Goes Live Inside Claude and ChatGPT
MoonPay launched PayBox on July 29, positioning it as a way to keep payments inside the AI conversation for Claude and ChatGPT users. The product is presented as a connector users install inside the assistant, after which the assistant can initiate crypto transfers and card payments without sending the user out to a separate checkout flow.
For traders and DeFi users, the immediate relevance is execution surface area. If the assistant can bridge, swap, or pay for services from the same chat where it is planning the action, the “context switch” friction drops, and the assistant becomes closer to an execution layer than a research tool.
MoonPay is also explicitly framing PayBox as an “open rails” bet rather than a closed checkout. The product is described as connecting Claude and ChatGPT to the x402 machine-to-machine payment standard, Visa’s agentic commerce tokenization protocol, and “eight supported blockchains,” with the eight enumerated as Solana plus seven EVM networks.
Non-Custodial by Design: MPC Key-Splitting Across TEEs
PayBox’s core security claim is non-custodial custody architecture built on multi-party computation (MPC), using threshold cryptography to split a private key into encrypted shares. Those shares are stored across hardware-isolated Trusted Execution Environments (TEEs), which are secure enclaves designed to keep secrets protected even from the host system.
Mechanically, the point is that no single actor holds enough key material to sign alone. The packet describes the design as preventing unilateral signing by the AI agent, MoonPay’s servers, or the user device. Signing requires a threshold of shares to cooperate, and the shares are not revealed to each other during the computation.
This is the part that changes the usual “agent wallet” threat model. A compromised MoonPay server is described as only obtaining one share, and a compromised user device is in the same position. Even if an agent is manipulated through prompt injection and tries to drain funds, the architecture is designed to block it from producing a valid signature by itself.
PayBox’s MPC infrastructure is attributed in the packet to Sodot, the Israeli cryptographic infrastructure firm MoonPay acquired on April 29 in an all-stock deal for roughly $100 million. The packet also references NISTIR 8214C, finalized in January 2026, as the public framework underpinning the threshold cryptography approach.
Always Ask vs Autonomous: Where the Risk Actually Moves
PayBox ships with two authorization modes that matter more than the chain list. “Always Ask” requires a fresh passkey approval for every transaction, while “Autonomous” allows the AI to spend within user-defined limits without per-transaction approval.
The mechanism MoonPay leans on is scoped authorization. Each passkey approval is described as single-action and expiring immediately after use. If the recipient address, amount, or destination network changes, PayBox requires a fresh passkey. The packet claims a captured or replayed authorization cannot be extended to other transactions.
That still leaves the residual risk where traders actually get hurt: decision risk under valid permissions. MPC can be strong at preventing MoonPay or the model from stealing keys. It does not prevent the AI from making a bad swap, choosing the wrong destination chain, or executing an unintended purchase if the action fits inside the configured limits.
The consequences differ by rail. Onchain transfers are irreversible, and the packet flags that stablecoin payments over x402 do not have card-network chargeback protections. Visa tokenization is meant to reduce the blast radius on card rails by keeping raw card numbers out of the agent context and scoping authorizations to a single action that expires immediately after use, closing the “leaked card number reused indefinitely” fraud vector.
The compliance packaging is also part of the product design. The packet cites an Aug. 2, 2026 EU AI Act Article 14 human-oversight deadline and positions “Always Ask” as satisfying that requirement, while warning that EU organizations using “Autonomous” should evaluate their obligations.
The MoonPay PayBox enables AI-native crypto payments Milestones Ahead
The next hard date in the narrative is Aug. 2, 2026, the cited EU AI Act Article 14 human-oversight deadline. The practical signal will be whether PayBox deployments in the EU steer users toward “Always Ask” by default, or whether “Autonomous” remains a first-class option without additional friction.
MoonPay says additional AI platforms beyond Claude and ChatGPT are planned, but the packet names no partners. Expansion beyond those two assistants is the distribution test, because the product’s value proposition depends on living where users already run agent workflows.
On the rails side, PayBox launched with Solana plus seven EVM networks. Any chain expansion beyond that initial set will indicate whether MoonPay is building a general cross-chain execution layer for agents or a curated set of venues. The packet also frames PayBox as connecting to open rails beyond blockchains, including x402 and Visa tokenization, but does not provide detail on additional rails.
What is missing so far is post-launch validation. The packet provides no transaction volumes, active users, fee schedule, or measurable DeFi usage tied to PayBox, which makes it hard to separate a product launch from a workflow shift.
Why This Matters for Traders: Open-Rails Agentic Payments vs Walled Checkouts
The threshold that matters is not whether MPC key-splitting works in the abstract. It is whether users can keep “Autonomous” limits tight enough that the inevitable model mistakes stay small, especially when the action is irreversible onchain or routed over x402 without chargebacks.
If EU deployments meaningfully bias toward “Always Ask” ahead of the Aug. 2 oversight deadline, that tells you where the product will land in practice: more like a passkey-gated execution surface than a true delegated agent wallet. If “Autonomous” becomes the default and MoonPay later adds higher-risk DeFi actions like perps and liquidity management under the same permissioning model, the product stops being a convenience layer and starts being a risk budget you have to actively manage.
