Attribution without names

Here is a wallet. It sits on Solana, it has taken twenty thousand payments in two days, and we have no idea who owns it. No website advertises it. No payment challenge on any domain we probe returns it. No registry lists it. By every naming mechanism we have, it is a blank.

And yet we know a great deal about it — more, in one sense, than we know about most companies with names and logos. We know every payment it ever received, to the cent and to the second. We know how many distinct payers it has, what it charges, and what it does with the money afterwards (nothing, as it happens). The chain records behaviour completely and identity not at all. That is the exact inversion of a traditional business directory, which knows every company’s name and almost nothing about what any of them actually does.

Naming is one kind of knowledge. Characterising is another. For an anonymous on-chain actor, the second is often the only kind that honestly exists — and the discipline is to publish it as itself, never dressed up as the first.

We measure the x402 settlement economy — agents paying agents for API calls, priced in USDC, settled on-chain. Attribution is the heart of that job: taking a raw settlement flow and saying whose business it represents. This note is about what attribution means when the “whose” is unanswerable — and why the answer we settled on makes our headline number smaller, stranger, and much easier to defend.

Two kinds of knowing

When people say a wallet is “attributed,” they almost always mean named: mapped to a real-world operator. This wallet is service so-and-so; that one is such-and-such’s router. Naming is genuinely valuable. It connects on-chain flow to off-chain accountability — a domain, a team, a thing you can contact or avoid.

But naming has a strict evidentiary bar, and anonymous wallets, by construction, don’t clear it. The temptation at that point is to lower the bar: the wallet looks like it belongs to such-and-such, the timing fits, someone on a forum said. Every tracker feels this pull, because a fully-named ledger is a better-looking product than a ledger with holes in it.

The alternative is to notice that there is a second, entirely separate kind of attribution available — one whose evidence is not scarce but overwhelming. Call it characterisation: a precise, checkable statement of what the wallet does. What it charges. How many payers it has. How its volume arrives. Whether the money ever moves onward. None of this requires knowing the owner, because all of it is sitting in public, signed, on the chain.

The two kinds of knowledge fail independently. A named wallet can still surprise you behaviourally; a characterised wallet tells you nothing about who to call. But they also succeed independently — and a measurement system that treats characterisation as a first-class output, rather than a consolation prize, stops facing a false choice between guessing and shrugging.

NULL is not zero — and a guess is worse than a gap

Before the describing can start, one doctrine has to be nailed down, because everything else leans on it: an unknown value is not a zero, and it is not a guess. It is an unknown, and it must stay visibly unknown until evidence arrives. Database people write it as NULL ≠ 0. It sounds like pedantry. It is the whole game.

Treat the unknown wallet as zero and you understate the economy — the money it took is real settlement, and pretending otherwise makes your total a fiction in the downward direction. Guess a name for it and you overstate your knowledge — which is worse, because of an asymmetry that deserves to be stated plainly:

A gap announces itself. A guess never does. On every dashboard, in every screenshot, forever, a guessed name is pixel-identical to a verified one — which means one printed guess quietly poisons the credibility of every real name around it.

We can show you what this doctrine costs, because we just paid it. In our most recent release we removed a set of names we could no longer stand behind — wallets that turned out to be shared infrastructure, honestly claimed by several unrelated services at once, where crediting any single claimant would fabricate a reputation. The result:

total x402 settlement            $54.05M
attributed to a NAMED service    $52.26M   (96.69%)

previous release, same figure   ~$52.74M
this release                     $52.26M  — lower.

peer tracker x402scan's
comparable attributed figure     $52.77M

Our attributed number went down when our method got better. A peer tracker’s comparable figure now sits about half a million dollars above ours, and we think our smaller number is the more defensible one — not because theirs is careless, but because ours has had names subtracted from it on principle. A number that is capable of going down when honesty demands it is the only kind worth trusting when it goes up.

But that still leaves roughly $1.79M of real settlement with no name on it. NULL ≠ 0 forbids us from zeroing it or guessing it. So what, concretely, do we do with it?

The wallet that describes itself

We describe it. Rigorously — which means every description is a behaviour class: a stated SQL predicate over the payment history, such that a wallet carries the label if and only if the query returns it. We currently maintain 39 such classes. Not clusters, not similarity scores, not a model’s opinion — predicates, written down, runnable by anyone with the data.

Here is the flagship example. This is the anonymous wallet from the top of this note, and this is everything we publish about it:

wallet 8wYeHi8k…

price:    $1.00 — flat, every single payment
volume:   20,369 payments in 2 days
payers:   1,243 distinct
outflow:  none. the $20,369 has never moved.

published label: "a $1.00 flat-rate endpoint that took
20,369 payments from 1,243 distinct payers in 2 days
and has never moved the money."

Read that label slowly, because every clause in it is doing work. “$1.00 flat-rate” is a claim about price dispersion: zero. “20,369 payments … in 2 days” is a claim about intensity. “1,243 distinct payers” is a claim about breadth — this is not one script hammering itself; over a thousand separate addresses chose to pay a dollar here. “Never moved the money” is a claim about what happened after. Each clause corresponds to a predicate over public data. Each is independently checkable by anyone with chain access. Each is falsifiable — if you find a second price point or an outbound transfer, the label is wrong and we have to change it.

Now notice what the label does not say. It does not say who operates the wallet. It does not say whether the endpoint is useful, or reputable, or a fair deal at a dollar. It does not even hint at a name. It is a description with the confidence turned exactly as high as the evidence supports and no higher — and that restraint is what makes it trustworthy.

Multiply this by 39 classes and the unnamed region of the economy stops being a fog. It becomes a catalogue of specific, verifiable behavioural facts about wallets whose owners remain — honestly, explicitly — unknown.

A decomposition that closes to the cent

Doctrine plus predicates gives you the published structure: every dollar of settlement lands in exactly one of three buckets, and the three buckets sum back to the total. Not roughly. To the cent.

$54.05M   total settlement
├─ $52.26M  attributed to a NAMED service   (96.69%)
├─ ~$1.17M  unnamed, but carrying a
│           BEHAVIOUR LABEL (one of 39
│           predicate-defined classes)
└─ ~$0.62M  genuinely unknown — and we
            say so, out loud

the three parts sum to the published total.
no dollar is in two buckets. no dollar is in none.

Why the arithmetic is the honesty

The closing-to-the-cent property is not an accounting flourish; it is the enforcement mechanism for NULL ≠ 0. If the buckets must sum to the total, then every dollar we can’t name has to go somewhere visible. We cannot round a mystery up into the named bucket without the numbers refusing to balance, and we cannot quietly drop it without the same alarm. Conservation turns honesty from a policy into a constraint the pipeline physically cannot violate without breaking its own build.

The shape of what we don’t know

Look at the proportions. Of the ~$1.79M we cannot attach to a name, roughly two-thirds — about $1.17M — carries a behaviour label. The genuinely dark region of a $54.05M economy is around $620,000: a bit over one percent of everything. That residue is the honest size of our ignorance, and publishing it as ignorance is the point. A tracker that claims 100% attribution isn’t seeing more than we are. It is guessing more than we are, and not saying so.

How a label becomes a name

A behaviour label is not a dead end. It is a holding state — the truthful description a wallet carries while the evidence for a name either arrives or doesn’t. Both outcomes are instructive, and we have a clean example of each.

Evidence arrives. One Base wallet sat for a while as exactly the kind of characterised-but-unnamed actor this note is about: a high-throughput router carrying $356,667 across 21,834,453 transactions. Then the naming-grade evidence showed up, and it was first-party: BlockRun’s own domain, when probed with a live payment challenge, answers with that wallet. The service itself, on infrastructure it controls, states where it wants to be paid. That is not an inference about the wallet; it is a declaration by its operator. A curator reviewed the proof and promoted the label to a name.

wallet 0xe9030014…  ·  $356,667  ·  21,834,453 tx

evidence: live payment challenges served by
BlockRun's own domain return this wallet.
first-party, verifiable, sufficient. → NAMED.

Evidence arrives — and forbids naming. Another Base wallet carries even more: $415,797 across 31,548,003 transactions. Here the probes came back too successful. Three unrelated services — aisa.one, lnpay.ai, paywall402.com — all honestly advertise this same wallet, because all three route their payments through it. Nobody is lying. And precisely because nobody is lying, printing any one of those names next to the wallet’s volume would hand one service the traffic of all three — a fabricated reputation built entirely from true facts. For this wallet, the label is the terminal, correct answer: “a shared routing wallet with three honest claimants,” all three shown, none credited. It belongs to a whole class we measured — 309 contested wallets carrying $920,236 across 55.4M transactions — where the most knowledgeable thing a tracker can print is, deliberately, not a name.

Same pipeline, opposite verdicts, one rule underneath: the description upgrades exactly when the evidence does, and never before. A label is what knowledge looks like while it’s still honest.

A label is a description, not a verdict

One boundary matters enough to draw twice. We’ve written before about wash patterns — echo harnesses, circulation loops, closed rings — where behavioural evidence supports an actual judgment: this flow is not commerce, exclude it. That is a different act from what this note describes, and conflating them would wreck both.

Behaviour labelling passes no judgment. Take 8wYeHi8k… again. Is a $1.00 flat-rate endpoint with 1,243 payers in two days a promising young API whose operator simply hasn’t withdrawn revenue yet? Quite possibly — over a thousand independent addresses paying a uniform price for something looks a lot like a product people want. Is it something stranger? Also possible. The label refuses to pick. It states what happened and stops, because what happened is all the evidence establishes.

This restraint cuts in the wallet’s favour more often than not. An anonymous seller with real, describable traction gets that traction counted and characterised instead of being zeroed for the crime of not having a website. NULL ≠ 0 protects the unknown honest actor exactly as much as it protects the reader — the wallet’s real activity stays in the economy’s total, under a truthful description, waiting for a name it may one day earn.

The shift worth internalising

Ask what attribution is actually for. If you are deciding whether to integrate against an endpoint, route payments through a hub, or trust a leaderboard row, the questions you really need answered are behavioural: does it deliver, what does it charge, how broad is its real demand, does the money move the way a business’s money moves. A name is a proxy for those answers. The description is those answers.

“We can’t tell you who this is, but we can tell you exactly what it does” is a more honest claim than a fabricated name — and, surprisingly often, a more useful one.

The census this note is built on is public and itemised. The Transparency page lists the unnamed wallets address by address with the behaviour label each one carries and the evidence behind it; the Integrity view holds the living versions of every figure printed above — this post is a dated photograph, and the site is the subject that keeps moving. If you can name a wallet we’ve only described, bring first-party proof and we will promote the label, gladly. And if you catch one of our 39 predicates misfiring, better still: a definition you can lose an argument with is the only kind we keep.