Anatomy of a Wash: How AIsa Faked x402 Dominance
On March 11, 2026, a company calling itself "Visa for AI" tweeted that the top x402 servers are "memecoin pump-and-dump." We traced their on-chain activity. Here's what we found: 24 relayer bots that are Polygon's official facilitator, 4.5 million fake transfers, $3,050 of USDC going in circles, a governance subsidy co-authored by the same Polygon employee who submitted the addresses, and a total cost of $5,718 to fake it all.
The Tweet
This looks like a neutral question from an industry observer. It's not. The account belongs to AIsa (AIPay, Inc.), a VC-backed company that claims to be the "#1 server" on x402 with "10.5 million transactions." They weren't on the leaderboard that day. Their 24 relayer bots — the same 24 addresses listed in Polygon's official facilitator documentation — had just been topped up with the largest MATIC deployment in the operation's history two days prior. And new sweep infrastructure was deployed hours before the tweet.
So who is this company?
Who Is AIsa?
A pre-seed startup that raised from Draper Associates by positioning as x402 infrastructure — then pivoted away from x402 while publicly undermining it.
AIsa (AIPay, Inc.)
Founded Jan 2025 in San Francisco by Jordan Liu (ex-UXUY, serial founder) and Joel Lian. Positions as "Visa for AI." Actual product: an LLM API reseller with Stripe billing and a Twitter scraper behind x402 paywall.
Pre-Seed — Oct 2025
Led by Draper Associates (Tim Draper). Investors include Fenbushi Capital (Shen Bo), BoostVC (Adam Draper). AIsa went through Draper/BoostVC's BitcoinFi Accelerator before the raise.
10 Repos. 10 Commits. Zero Payment Code.
The entire GitHub org (AIsa-team) has 2 followers. Every repo is a single-commit dump. No x402 SDK, no facilitator code, no escrow contracts. The "awesome-aisa" repo is a README with one line: # awesome-aisa.
Jordan Liu Personally Invested in x402
The founder authored a 3,000-word essay on 36kr — "HTTP 402 and Micropayments: The 30-Year-Dormant Code Revives in the AI Era" — positioning AIsa as "the key to HTTP 402." Published October 3, right before the pre-seed close. Their Notion whitepaper includes a leftover ChatGPT editing artifact in the published text.
But the story they told kept changing.
The Shapeshifter
Three protocol narratives in seven months. The technology story changed depending on who was in the room.
So we followed the money.
We Started at the PayTo Address
We started at the one address where AIsa receives all its x402 payments. Then we asked: who sends money there? Who funds those senders? Who funds those funders? Each hop revealed another layer — ghost wallets, a USDC recycling loop, a custom token, a smart wallet factory, 24 relayer bots that turned out to be Polygon's official facilitator, and a governance proposal to make the whole thing free.
Here's what we found when we added it all up:
The Machine
One funder address — 0x89ab9dc912526c573D...9BbD6 — holds a custom token called POLYGON402, and is the sole source of gas for 24 relayer bots. Nobody else has ever funded them.
The funder topped up relayer bots in batches, scaling from 1 to 23 active bots over 5 months:
| Date | Bots Funded | MATIC Each | Total MATIC | Context |
|---|---|---|---|---|
| Oct 30, 2025 | 1 | 10 | 10 | First relayer seeded. Same day POLYGON402 deployed. |
| Nov 5, 2025 | 1 | 390 | 390 | First serious gas budget. 3 days before addresses committed to Polygon repo. |
| Jan 5–7, 2026 | 3 | 98–1,999 | ~4,296 | Scaling begins. |
| Feb 2, 2026 | 9 | 1,999 | ~17,991 | Post-January wash wave documented by independent researchers. |
| Feb 18, 2026 | 15 | 1,999 | ~29,985 | 8 days after independent research publishes wash analysis |
| Mar 9, 2026 | 23 | 3,999 | ~91,977 | 2 days before the tweet. Largest single deployment. |
Ghost wallets send $0.01 to 9 collection addresses, all starting with 0x66f. Odds of that happening randomly: 1 in 1029. Eight of nine also share the suffix ec8. These were mined on purpose.
| Collection Address | Transfers |
|---|---|
| 0x66FA4D79cA84016b42352BE33C908Dd812952Ec8 | 4,026,247 |
| 0x66f3c28336873e1FE99F669B1703DC4DC18b9ec8 | 188,780 |
| 0x66fBF371C75713Fe73d0a7EFa43961A869892EC8 | 97,089 |
| + 6 more identified (counter lag on recent addresses). Combined confirmed: 4,312,116+ | |
On October 30, 2025 — the same day the first relayer was seeded — a custom ERC-20 token called POLYGON402 was deployed on Polygon. Four wallets minted it. One of them is 0x89ab — the funder of all 24 facilitator bots. The deployer was funded by a genesis wallet whose only transaction ever was sending 140 MATIC. The chain: genesis → deployer → token → funder → 24 relayers. It's the breadcrumb that links the entire operation to a single origin point.
Technical: Reverse-Engineered ABI Details
We recovered the ABI from creation bytecode before the contract was destroyed: 45 function selectors, 38 resolved, 7 unique. Functions include mintFree, batchMintFree, mintPaid, batchMintPaid, MARKETING_PERCENTAGE, transferMarketingTokens, and allocation tracking (FREE_MINT_SUPPLY, PAID_MINT_SUPPLY). We searched GitHub for this combination — zero matches anywhere. This is custom code. The deployer (0x87162c...A07C) was funded by a genesis wallet (0xBfdd97...c15E) whose only transaction was sending 140 MATIC. Token contract: 0x5845b7F4...c57dB (destroyed).
But then we checked who else uses these exact 24 addresses.
The Loop
The USDC doesn't leave the system. It goes in a circle. We traced every leg.
The Closed-Loop USDC Cycle
Supplier (0x897720c5...BbAb8) distributes $100 USDC to each ghost wallet. Ghost wallets drain at $0.01/transfer to the 9 collection addresses. When a collection address accumulates enough, it sends exactly $3,050 back to the supplier. Same dollars. Around and around.
| # | Date | Amount | From | To |
|---|---|---|---|---|
| 1 | Jan 20, 2026 | $3,050 | 0x66FA (payTo) | Supplier |
| 2 | Jan 21, 2026 | $3,050 | 0x66FA (payTo) | Supplier |
| 3 | Jan 27, 2026 | $3,050 | 0x66FA (payTo) | Supplier |
| 4 | Jan 30, 2026 | $3,050 | 0x66FA (payTo) | Supplier |
| 5 | Feb 15, 2026 | $3,050 | 0x66FA (payTo) | Supplier |
| 6 | Mar 3, 2026 | $3,050 | 0x66FA (payTo) | Supplier |
| 7 | Mar 3, 2026 | $3,050 | 0x66f3 (secondary) | Supplier |
| 8 | Mar 8, 2026 | $3,050 | 0x66FA (payTo) | Supplier |
| 9 | Mar 11, 2026 | $3,050 | 0x66FA (payTo) | Supplier |
| 10 | Mar 11, 2026 | $3,050 | 0x66fB (secondary) | Supplier |
The MATIC price at time of verification: $0.0989 (CoinGecko). The gas figure is exact: 57,820 MATIC burned, calculated from the balance sheet across all 24 relayer wallets.
The addresses running this operation aren't random. They're official.
The Polygon Connection
We compared the 24 relayer addresses funded by 0x89ab to the 24 addresses listed in Polygon's official x402 facilitator documentation. They are the same addresses. All 24.
Every Polygon Facilitator Address Is Funded by AIsa's Operator
Polygon's documentation at docs.polygon.technology lists 24 wallet addresses across three key sets (x402_1.keys, x402_2.keys, x402_3.keys) as the "Polygon Facilitator." Every one of those 24 addresses was funded with MATIC by 0x89ab — the POLYGON402 holder. No other entity has ever sent MATIC to any of them.
Submitted by a Polygon Employee
On November 8, 2025, Akshat Gada (LinkedIn: "DevRel At Polygon") committed the 24 addresses to the x402facilitators package. Commit message: "feat: add Polygon facilitator with 24 addresses." Bruno Skvorc (@Swader, GitHub company: @0xpolygon) merged it.
17 Shadow Addresses
For 17 of the 24 facilitator addresses, there exists a shadow address with the exact same 4-character prefix AND 4-character suffix — but different middle bytes. 17/17 match. These shadow addresses sent 0-value transactions to the funder on the same days as major MATIC top-ups. They were generated in the same vanity mining batch as the facilitator addresses. Same tooling, same operator.
One Address Wasn't in the Docs
The funder sent MATIC to 25 addresses total. 24 appear in Polygon's facilitator documentation. The 25th — 0x3ef57def668054dD...f104F — received only 1 MATIC. It's not in the facilitator docs. We didn't know what it was. Until we read the governance proposal.
Two days after independent research was published documenting that these transactions were gamed, Polygon proposed paying for them.
The Subsidy
PIP-82: "Agentic Commerce Gas Program." A governance proposal to redirect up to $1 million in Polygon network fees to subsidize gas for the 24 facilitator addresses.
PIP-82 Co-Authored by Akshat Gada
The same Polygon DevRel engineer who committed the 24 facilitator addresses on November 8 co-authored the governance proposal to subsidize gas for those exact addresses. Authors listed: "David Silverman, John Egan, Akshat Gada, James Lawton."
Posted 2 Days After "Is it GAMED?"
Independent research documenting 30 wallets sending 1.93M transactions of $0.01 USDC to AIsa's address was published on February 10, 2026. PIP-82 was posted on February 12, 2026. It was bolted onto PIP-81 (the Lisovo hardfork) after the hardfork was already specified. 326 forum views. 3 community responses. One commenter called it "bad" and a "bribe." It passed and was activated March 4.
The 25th Address
PIP-82 redirects Polygon's EIP-1559 base fees to a new address: 0x3ef57def668054dD750BD260526105C4EEEf104F. This is the 25th address funded by 0x89ab — the one that wasn't in Polygon's facilitator docs. The same entity that deployed the wash infrastructure created the address that the protocol's fee redistribution now routes through.
Deploy. Run. Tweet. Destroy.
The Ghost Factory
On March 11, two smart contracts were deployed, used, and destroyed within hours. Their bytecode — the code that reveals how the ghost wallets were created and controlled — is gone. We recovered the function signatures before the code disappeared.
eth_getCode. The sweep dispatcher (0x4F92749B) and the POLYGON402 token (0x5845b7F4) were wiped via selfdestruct. The code that managed the ghost wallets, tracked ownership, and authorized sweeps no longer exists on-chain. But the creation transactions are permanent — and that's where we found the signatures.
What the Sweep Dispatcher Did
Deployed at 0x4F92749B...816Afd (creation TX). We extracted 12 function selectors from its creation bytecode and resolved 7:
masterOf(address) — returns who controls a given wallet
getAddress(address, uint256) — computes a wallet address from master + index
sweepAll(address[]) — drains all balances from an array of wallets in one call
FailedDeployment() — error: wallet creation failed
InsufficientBalance(uint256, uint256) — error: nothing to sweep
A counterfactual smart wallet factory. It generates wallet addresses deterministically (master + index), tracks ownership, and batch-sweeps all their balances in one transaction. One call to sweepAll with an array of 50 addresses drains 50 wallets atomically. 474 calls swept thousands.
Why Not Regular Wallets?
A regular wallet requires its private key holder to sign every transaction. To collect funds from 10,000 regular wallets, you need 10,000 keys and 10,000 signatures. A smart wallet deployed by a factory has built-in authority — the factory owner calls sweepAll and drains any wallet it created, without needing that wallet's key. The ghost wallets never initiate transactions themselves. USDC leaves via transferWithAuthorization (facilitator submits). USDC and MATIC return via sweepAll (factory owner triggers). The ghost wallet is entirely passive on-chain.
The tools were used and discarded. The wallets they created — and the transactions those wallets generated — are permanent.
March 11: The Exit
Deploy infrastructure. Run it. Tweet. Destroy the tools. Here's what happened on March 11, 2026, in order.
| Time (UTC) | Event |
|---|---|
| 00:20 | $6,100 USDC recycled (2 × $3,050 from collection addresses to supplier) |
| 05:57 | $33M whale wallet 0x1347378B sends 1,000 MATIC to intermediary |
| 06:02 | Intermediary sends 10 MATIC to sweep operator 0xd9a50DB1 |
| 06:03 | Sweep dispatcher contract deployed (TX) |
| 06:04–13:13 | 469 sweepAll calls on 3 smart wallets — collecting USDC + MATIC |
| 15:14–15:18 | 5 batch dispatcher calls through factory-generated wallets |
| ~16:12 | @AIsaOneHQ tweets: "x402 top servers are memecoin launchpads" |
| After tweet | Dispatcher contract bytecode wiped (selfdestruct) |
| After tweet | POLYGON402 token bytecode confirmed wiped |
A 7-Step Exit
Feb 12: Secure gas subsidy for old system (PIP-82, co-authored by Akshat Gada). The parachute is packed.
Mar 4: Subsidy activates. Gas is now free for the 24 addresses. The engine runs free.
Mar 9: Max-fund the machine — 91,977 MATIC to 23 relayers (largest ever). The tank is filled.
Mar 11: Deploy sweep → collect remaining USDC/MATIC → tweet → destroy contracts. The building burns. The tweet goes out. The tools disappear.
Mar 12: Machine still running on autopilot. 4.5M transactions. 300/minute. The machine runs itself.
The 24 facilitator addresses are funded, the gas is subsidized, the USDC recycles automatically. No operator presence needed. The numbers keep going up for Polygon's metrics while AIsa builds something else.
$33 Million Upstream
The sweep infrastructure traces back to 0x1347378B1d0Eb69d...ebE74eC — a wallet holding $20.7M USDT, $7.7M USDC, $5.0M USDC.E, and 211,794 MATIC. 46,887 transactions, 181,595 token transfers — all on Polygon, zero on any other chain. No public label on any explorer. It distributes MATIC and stablecoins to dozens of sub-wallets daily. Its Polygon-only activity, massive stablecoin holdings, and pattern of funding operational sub-wallets is consistent with a Polygon-native operational treasury.
The Complete Picture
A company and a blockchain coordinated to inflate a metric. The company used that metric to raise money and claim market leadership. The blockchain used it to compete with a rival chain and justify a million-dollar subsidy. Then the company publicly trashed the ecosystem it helped inflate, while the machine it built keeps running on autopilot — funded, subsidized, and generating numbers for a leaderboard nobody's checking.
Every node is a verified on-chain address. Every edge is a verified transaction.
Five parallel tracks from June 2025 to March 2026: token setup, facilitator infrastructure, AIsa press, Polygon governance, USDC cycle.
For interactive exploration, trace the funder address on MetaSleuth.
Don't trust this report. Check the chain.
Verify It Yourself
Don't trust this report. Check the chain. Every address, commit, and document below is public.
| Role | Address / Link | What to Check |
|---|---|---|
| AIsa PayTo | 0x66FA4D79cA84016b42352BE33C908Dd812952Ec8 | 4M+ token transfers, all $0.01 USDC |
| Funder (POLYGON402) | 0x89ab9dc912526c573D630D6342F46d0522d9BbD6 | Outbound txns: 24 relayers funded with MATIC |
| Top Relayer | 0x971b4079A618F72Fa0F1792b07ed5923dfBF3500 | 193K+ txns, all transferWithAuthorization |
| USDC Supplier | 0x897720c5b19f93F3194990D0121d3a64783BbAb8 | Incoming: $3,050 refills from payTo. Outgoing: $100 per ghost. |
| PIP-82 Burn Recipient | 0x3EF57dEf668054dD750BD260526105C4EEEf104F | The 25th address. 1 MATIC from funder. |
| Sweep Operator | 0xd9a50DB1e4644cA643296e60b0b195A714E41901 | 474 txns, all March 11 (tweet day) |
| Dispatcher Contract | 0x4F92749B1CF0814ea31548969B5084937a816Afd | Unverified contract, deployed March 11 |
| POLYGON402 Token | 0x5845b7F431d004615e6C69F4cF43663cBF8c57dB | Custom token. 28K supply, 3 holders. |
| Token Deployer | 0x87162cB0E3B0869ee7A87e739Ed444Ba8f22A07C | 8 txns Oct 29–Nov 1, then silent forever. |
| Genesis Funder | 0xBfdd97a6DbaF3284354D0F450F3E424f6F30c15E | 1 tx ever. 150 MATIC untouched. |
| PayTo (Base) | 0x66FA4D79cA84016b42352BE33C908Dd812952Ec8 | 31.5M token transfers on Base, same address. |
| Document | Link |
|---|---|
| Polygon Facilitator Docs (24 addresses) | docs.polygon.technology |
| GitHub Commit Adding 24 Addresses | Swader/x402facilitators commit |
| PIP-82 Governance Proposal | forum.polygon.technology |
| Akshat Gada LinkedIn | linkedin.com |
| MetaSleuth Interactive Graph | metasleuth.io |
| AIsa GitHub Org | github.com/AIsa-team |
How to Reproduce This Analysis
1. Go to the PayTo token transfers on Polygonscan. Note: all $0.01 USDC, dozens of unique senders.
2. Click any sender address. Note: 0 transactions, 0 token transfers. Ghost wallets.
3. Pick a transfer TX → check the gas payer (From field). That's a relayer bot. Note: 100K+ transactions.
4. Check the relayer's incoming txns. Follow the MATIC funding to the funder. Note: it funds 24 bots.
5. Check the funder's token holdings. Note: POLYGON402 token, 3 holders.
6. Compare the 24 funded addresses to Polygon's facilitator docs. They are the same 24 addresses.
7. Read PIP-82. Note the authors. Note the burn recipient address. Note the date (2 days after published wash analysis).