Stablecoins in 2026: $300B in Supply, 1% Real Payments, and Rails Being Rebuilt for Agents

I have avoided writing about crypto on this blog because most of what gets written about it is either a sales pitch or a sneer, and I did not have anything to add to either. What changed my mind is that the customers of my compute platform are increasingly programs rather than people, I wrote about that yesterday, and a program that wants to buy a microVM for eleven seconds has a payments problem a human with a credit card does not. Every serious proposal for solving that problem in 2026 involves a dollar-pegged token on a public ledger. So I spent the week reading the primary sources: the regulators' rulemakings, the issuers' attestations, the card networks' press releases, and the protocol specs. This is what I found, as of 7 September 2026, with the numbers that survive scrutiny separated from the numbers that do not.

The short version is that there are two different things being called "stablecoin payments". One is a settlement layer between institutions that is real, growing fast, and regulated in slow motion. The other is a machine-to-machine micropayment layer for AI agents that has enormous transaction counts, almost no money, and a standards war under way. They share a token and not much else.

Part 1: The money that exists

Start with supply, because it is the one number nobody disputes. From DefiLlama's API this morning: Tether's USDT at $183.4 billion, Circle's USDC at $74.7 billion, then a long tail (USDS $6.6B, DAI $4.8B, Ethena's synthetic USDe $4.4B, USD1 $4.3B, PayPal's PYUSD $2.9B, BlackRock's tokenised fund BUIDL $2.8B, Ripple's RLUSD $2.4B). The total is somewhere between $300 and $320 billion depending on which tracker and which day; the Bank for International Settlements used about $320 billion at end of May in its annual report, and 99.4% of it is pegged to the US dollar. Both of the big issuers publish audited figures that line up: Circle reported USDC at $73.3 billion on 30 June, up 19% year on year, and Tether's second-quarter attestation put USDT around $184.6 billion with roughly $115 billion of it in US Treasuries.

That last figure is why central banks now write chapters about this. An issuer holding $115 billion of T-bills is a Treasury holder on the scale of a mid-sized country, and it is holding them because a "stablecoin" is, mechanically, a money-market fund whose shares are bearer tokens. The BIS chapter argues the design fails three tests of money: singleness (secondary prices deviate from par), elasticity (issuance is cash-in-advance, so it cannot expand in a crunch) and integrity. I find the first two persuasive as descriptions of a limitation and unpersuasive as predictions of failure, because nobody is using USDC as a central-bank reserve; they are using it as a wire transfer that settles on Saturday.

Volume is where the numbers get slippery, and it is worth being precise because the same week produces headlines of "$35 trillion" and "$390 billion" for the same activity.

The raw figure, about $35 trillion in 2025, counts every on-chain transfer including exchange rebalancing, arbitrage bots and MEV. Visa's Onchain Analytics dashboard, built on Allium, strips out the obvious bot traffic and reported $1.79 trillion for June 2026 alone, up 125% year on year, with USDC at 67% of the adjusted volume against USDT's 32%. The McKinsey and Artemis study went further and tried to isolate transfers that are actually payments, meaning a good or service changed hands: about $390 billion for 2025, roughly 1% of the raw number, of which B2B was $226 billion (up 733% year on year), payroll and remittance $90 billion, and card-linked spend $4.5 billion. Artemis also found that the top 1,000 sending wallets account for 84% of transfer volume. This is not a retail phenomenon. It is a few thousand institutions moving money to each other on weekends.

That is also exactly the thing the incumbents have decided to own rather than fight:

Rail	What is live as of September 2026	Source
Visa	USDC settlement with US banks; $7B annualised run-rate, up 50% quarter on quarter; nine chains; 130+ stablecoin card programs	Visa, 29 Apr 2026
Mastercard	Settlement in USDC, PYUSD, USDG, USDP, RLUSD across eight chains, intraday and weekend cycles; acquired BVNK for $1.8B	announced 3 Jun 2026, primary release not reachable; The Block
Stripe / Bridge	Stablecoin accounts in 101 countries; Open Issuance; Tempo, its own L1 with Paradigm, mainnet since 18 Mar 2026, fees paid in any USD stablecoin, no gas token	Stripe, Tempo docs
Circle	Payments Network at $23B annualised in July, 175 institutions; Arc L1 with USDC as gas, permissioned validators including BlackRock, DTCC, Visa, Mastercard; mainnet 16 Sep 2026	Circle Q2
Western Union	USDPT live on Solana since 4 May 2026, issued by Anchorage Digital Bank; treasury and agent settlement first	WU
JPMorgan	JPMD deposit token live for institutional clients on Base; Kinexys over $5B/day	JPMorgan, 28 Apr 2026
21-bank consortium	Announced 1 Sep 2026: BofA, Citi, Goldman, Wells, Deutsche, UBS, MUFG and others; USD token targeted H1 2027, no name or chain yet	secondary reporting only

Two of the world's four largest payment companies now run their own blockchains, and the banks that spent 2022 saying "blockchain not bitcoin" are about to issue a coin on a public one. The pattern I see, wearing my infrastructure hat: every large player that used to route over Ethereum has concluded that fee volatility and shared-tenant congestion are unacceptable for a settlement rail, and has built or is building a chain where the gas is the dollar and the validators are named. Tempo uses a Simplex BFT consensus with sub-second finality and a modified EVM; Arc uses a Tendermint-derived protocol with a claimed sub-500ms finality and a permissioned validator set. Neither is decentralised in the sense the word meant in 2017, and neither is pretending to be. They are consortium databases with an open read API and a compatibility layer for existing wallets. That is a fine thing to be.

Part 2: The regulation that is still proposed

The GENIUS Act was signed on 18 July 2025 and the coverage since has mostly said "stablecoins are now regulated in the US". They are not, yet. The Act gave regulators until 18 July 2026 to issue rules and takes effect on the earlier of 18 January 2027 or 120 days after final rules. As of this week every substantive rule is a proposal:

• The OCC's comprehensive framework for permitted issuers was proposed on 2 March 2026, with a $5 million capital floor for new issuers, a 40% per-institution reserve concentration cap, a maximum weighted-average reserve maturity of 20 days, and a rule that state-chartered issuers crossing $10 billion must move to federal supervision within 360 days.
• The FDIC's substantive standards and the FinCEN/OFAC anti-money-laundering program rules were both proposed on 10 April 2026.
• Treasury proposed the rule defining who must be a permitted issuer on 17 August 2026, a month after the statutory deadline for final rules, with a 60-day comment period.
• The Federal Reserve had not proposed its rule as of mid-year.

So the licensing regime will not be final before 2027, and the statute's own backstop compliance deadline is 18 July 2028. What has happened is chartering: the OCC gave Circle final approval for a national trust bank on 10 July 2026, after conditional approvals in December for Circle, Paxos, Ripple, BitGo and Fidelity Digital Assets. A trust charter is not an issuer licence, but it is the thing an issuer licence will be attached to.

Elsewhere the picture is more finished. Under MiCA, ESMA's register lists 23 authorised e-money token issuers across 13 countries, including Circle, Paxos and Société Générale's SG-FORGE; Tether is not on it, has no notified white paper, and was delisted for EEA users in early 2025. The Bank of England published draft rules for systemic stablecoins on 22 June, dropping its earlier idea of per-person holding limits in favour of a £40 billion issuance guardrail per coin and allowing 70% of backing in short-dated gilts. Hong Kong issued its first two licences on 10 April, to HSBC and a Standard Chartered joint venture. Singapore's draft framework, out on 1 September, forbids paying interest to holders, which is the provision that will matter most for the business model. Japan's three megabanks plan a joint yen coin by March 2027.

The regulatory arbitrage is visible in the register. The largest coin by a factor of two is the one absent from every licensed list, and its issuer is the one holding $115 billion of Treasuries. Whatever the rules eventually say, they will be written around a market that already exists.

Part 3: The money that does not exist yet

Now the part that made me start reading. In 2025 and 2026 four separate camps proposed standards for one program paying another:

x402 (Coinbase, now a Linux Foundation project) resurrects the HTTP 402 status code. A server returns 402 with a payment requirement; the client signs a gasless USDC transfer and retries with a PAYMENT-SIGNATURE header; the server hands the signature to a facilitator that verifies and settles it on-chain. The foundation's members as of April include Adyen, AWS, Amex, Circle, Cloudflare, Google, Mastercard, Microsoft, Shopify, Stripe and Visa, which is a remarkable list for a protocol whose cumulative volume Coinbase put at about $50 million.

AP2 (Google's Agent Payments Protocol) is about mandates: signed, verifiable statements of what a human authorised an agent to buy, including "human not present" mandates added in April. Google donated it to the FIDO Alliance on 28 April 2026 along with a Mastercard-co-developed "Verifiable Intent" standard. It has published no volume.

The card networks are extending tokenisation. Visa's Trusted Agent Protocol, built with Cloudflare, has live transactions with around 30 European issuers at a handful of merchants. Mastercard's Agent Pay completed its US rollout in November 2025 and on 10 June 2026 launched "Agent Pay for Machines" with stablecoin settlement and a consent registry on Polygon, Solana and Base. Stripe's Agentic Commerce Protocol, built with OpenAI, powers ChatGPT's instant checkout and extended its Shared Payment Tokens to Visa and Mastercard agentic tokens in March. None of the three publishes volume.

Tempo's Machine Payments Protocol adds a "session" primitive: authorise a spending cap once, then stream sub-cent payments against it, with Stripe, Visa and Lightning as settlement extensions.

Here is x402 concretely, because it is the one with a public spec and open code, and because its design tells you what the others are competing with. A protected resource responds:

HTTP/1.1 402 Payment Required
PAYMENT-REQUIRED: <base64 of the JSON below>

{
  "x402Version": 2,
  "resource": { "url": "https://api.example.com/premium-data" },
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:84532",
    "amount": "10000",
    "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
    "payTo": "0x2096...287C",
    "maxTimeoutSeconds": 60,
    "extra": { "name": "USDC", "version": "2" }
  }]
}

The amount is in the asset's smallest unit, so 10000 is one cent of USDC. The client side is a fetch wrapper:

import { wrapFetchWithPayment } from "@x402/fetch";

const fetchWithPayment = wrapFetchWithPayment(globalThis.fetch, client);
const res = await fetchWithPayment("https://api.example.com/premium-data");

and the server side, in Express, is a middleware that lists which routes cost what:

app.use(paymentMiddleware({
  "GET /premium-data": { accepts: [/* as above */], description: "Premium data" },
}));

The signature the client produces is an EIP-3009 transferWithAuthorization, which is the mechanism that lets the facilitator pay the gas so the agent never needs to hold anything but USDC. The protocol charges no fee; facilitators may. There were 18 facilitators across seven chains by July.

It is a clean design, and I would happily put it in front of an API. But look at the numbers. Coinbase's own figures in April were 69,000 active agents, 165 million transactions and about $50 million cumulative: an average transaction of thirty cents. The x402.org dashboard this week shows 75 million transactions and $24 million over 30 days, so the run rate is up, but a CoinDesk analysis in March put real commerce on the protocol at around $28,000 a day with about half of the activity "gamified", meaning apps that pay agents to make transactions so the charts go up. I could only see that figure in a search snippet, so hold it loosely; but I have run enough free-tier platforms to know what a chart of 165 million transactions worth $50 million looks like from the inside. It looks like a loop.

Cloudflare's Monetization Gateway, which opened a waitlist on 1 July, is the most interesting application because it is the first to price the thing agents actually consume from infrastructure providers: pages, API calls and MCP tool invocations, settled over x402 in USDC, with example prices of a cent per request or 99 cents per resolved escalation. That is the unit economics of my previous post with a settlement rail attached. Whether "NET Dollar", the stablecoin Cloudflare announced last September, ever ships is unclear; the July post does not mention it.

What I would build, and what I would not

I have not wired any of this into PandaStack, and I want to be honest about why, because the reasons are more instructive than a demo would be.

The settlement layer is worth using now for one thing: paying and getting paid across borders on a weekend. If you run a business where contractors in four countries invoice you, or where a customer in Lagos wants to buy compute, a Bridge or Circle account that lands USDC in minutes at a fraction of a percent is materially better than the correspondent-banking path, and the licensed issuers now carry enough regulatory weight that "will my bank close my account" has a defensible answer. I would use USDC, issued by a company with a national trust charter and a published attestation, and I would not use the coin that is absent from every register on the grounds that being twice as big does not make you licensed.

The agent-payments layer is not ready to bill against, and the reason is not the protocol. The reason is the thing the protocol assumes: an agent with a wallet, a spending policy, and a principal who will honour the charge. That is an identity and authorisation problem, and I will write about it separately this week, because the standards for who is this agent and what may it spend are further behind than the standards for how does it hand over a cent. x402 gets you a signed transfer. It does not get you a refund, a dispute, a rate limit tied to a customer, or an answer when the agent buys 40,000 microVMs because a prompt injection told it to. The card networks' protocols are boring by comparison precisely because they start from mandates and consent registries rather than from a status code. My guess is that the winning design looks like AP2's mandates carried over x402's wire, and that it is not written yet.

If you do expose an x402 endpoint, treat the facilitator as a payment processor and design accordingly. It sees every transaction, it chooses when to settle, and if it goes down your API is down for paying clients. Run two. Verify the signature yourself before you trust the facilitator's /verify response; the Resolv hack in March, where a stolen AWS KMS signing key minted 80 million unbacked tokens and took the coin to twenty cents, is the reminder that every one of these systems is only as good as the key management behind the party you are trusting. Three-quarters of the roughly $950 million lost to exploits in the first half of 2026 was key or credential compromise, not smart-contract bugs. That is the same failure mode as every cloud breach I have ever read a postmortem for, and the fix is the same: short-lived credentials, hardware-bound keys, and a human between the agent and anything that moves money.

The BIS, the ECB and the Bloomberg sceptics are right that stablecoins are not money in the central-bank sense and probably do not create net new Treasury demand. They are also, I think, arguing with a claim nobody who runs infrastructure is making. What has actually been built is a settlement network for institutions that never closes, with the dollar as gas and the validators named, and a set of competing envelopes for letting programs pay each other a cent. The first is done. The second is a spec war with $50 million of real money behind it, and the interesting question for the next year is not which protocol wins but who solves identity first.

---

Related: Seats Are Dying: The 2026 SaaS Repricing and What Scale to Zero Cost Me to Build.