Can coding agents set up a crypto wallet? 13 agents, 18 wallets

Agents are starting to hold money. Before an agent pays for anything, it has to do something duller: install a wallet tool, make a wallet, prove it controls it, and tell its person where the keys live. We wanted to know how well today's coding agents do that on their own.

So we paired 13 coding agents with 18 wallet tools, 234 pairs in all, gave every pair its own fresh machine, and sent each the same instructions. This post is the first part of that survey, Agent Wallet Bench v7: installing a wallet, making one and signing with it. The money tests (receiving and refunding USDC, paying for an API with x402, paying through Patchbay) were not run this time.

The full results are in a spreadsheet you can download: agent-wallet-bench-v7.csv.

The short version

• Installing is mostly solved. 212 of 234 agents installed their wallet tool from its official page on the first try. Leave out one wallet that cannot run on a machine with no screen, and it is 212 of 221.
• Making a wallet is not. No pair earned a clean pass on the wallet test. 17 passed with a flag, 94 stopped at a sign-in that needs a person, and 70 ended without a clear answer.
• Hosted wallets wait for a person, by design. Every one of the 94 stops was on one of nine wallets that need a browser sign-in, a code or a Terms acceptance. No agent got past one of these on its own, which is the right behaviour.
• On self-run wallets, caution stopped the agents, not skill. When we told a cautious agent to go ahead, two in three made a working wallet.
• Every wallet an agent kept has its key or password in a plain file. None of these machines had a keychain, so there was nowhere safer to put it. We think agents should say so plainly.
• Eight runs leaked a secret into the agent's own record, mostly while typing a password into a prompt built for a person at a keyboard.

What we tested

Each pair got its own Fly Sprite: a fresh Ubuntu 26.04 machine with 8 processors, no screen and no administrator rights. Every agent ran the same model, gpt-6-luna at high effort, so the differences below come from the agent's own tools and habits and the wallet itself, not from a stronger or weaker model.

The make-a-wallet answer was scored on five points: a wallet the agent keeps, a signature that checks out, a third check that stayed open in this run, an accurate account of custody and recovery, and an accurate account of which chains it works on.

The agents: Muse Code, Grok Build, Hermes Agent, Claude Code, Cline, Kilo Code, Pi, oh-my-pi, OpenAI Codex CLI, DeepSeek Harness, OpenCode, IronClaw and Prime Agent. Three more on our list could not run on these machines: OpenAI Dot has no Linux version, Command Code needs a maker account before it will start, and NemoClaw with OpenClaw needs a licence acceptance and full Docker access.

The wallets: Bankr, MetaMask Agent Wallet, MoonPay, Coinbase CDP, Coinbase Agentic Wallet, Phantom, Foundry Cast, Ape, Circle, Safe, Web3Signer, Zerion, Splits, Privy Agent CLI, Tether WDK, Turnkey, 0xSequence Ethkit and Fireblocks.

Each pair had one attempt. When an agent stopped out of caution, we sometimes sent one short follow-up ("go ahead", or "please print the signature"). Those follow-ups are reported separately and never change the headline numbers.

Installing: mostly solved

• 212 of 234 installs worked on the first try.
• The one wall was Coinbase Agentic Wallet. Its wallet server is a desktop app, and these machines have no screen. All 13 agents failed it. The furthest anyone got was Codex, which started the app on a private virtual screen, but it still never answered.
• Leave that wallet out, and also IronClaw, whose own safety rules refused or hid several install commands, and it is 202 of 204.
• The two remaining misses were each an agent changing a shared npm setting that then broke Node. Both agents fixed it on their second try.

Common snags the agents worked round: npm refusing global installs, npm 12 holding back setup scripts, Python 3.14 being newer than Ape supports, and a Safe package missing one of its own dependencies.

Making a wallet: the hard part

"Not run" covers 25 tests we held back while a scoring question was open and never sent once the run ended, and 17 that were never planned. "Prompt never arrived" is Cline, which cannot continue a conversation without a screen.

Hosted wallets wait for a person

All 94 "waiting for a person" results sit on nine wallets: Bankr, MetaMask, Coinbase CDP, Phantom, Privy, Turnkey, Fireblocks, Circle and Splits. Each needs a browser sign-in, an emailed code, a company workspace or a Terms acceptance before it will make a wallet. The agents found the step, described it, and stopped.

That is what we want. No agent accepted Terms for its person, finished a login on its own, used administrator rights or moved funds. The one completed login in the whole run was Circle's, where a person typed the code.

How well agents described the hosted wallets varied. Custody was the weak point, not chains: every Coinbase CDP answer got custody wrong, and Bankr's did on every pair but one.

Self-run wallets: caution, not skill

Six wallets need no person at all: Foundry, Ape, Safe, Web3Signer, Zerion and Ethkit. On these, agents chose to stop 48 times, usually because they doubted the machine's disk would survive a restart and did not want to make a key that might vanish.

When we sent a cautious agent a plain go-ahead, 42 times in all:

• 28 made a kept wallet with a signature that checks out;
• 8 still ended without a clear answer;
• 5 leaked a password or passphrase on the way;
• 1 was blocked by the agent's own rules.

Agents also tended to keep their work to themselves. Of 23 wallets made without a go-ahead, 19 only showed their signature after we asked for it.

Keys in plain files

Every wallet an agent kept, 50 results across the main tests and follow-ups, stores its key, or the password that unlocks it, in a plain file only the machine's user can read. No agent found a better home, because these machines have no keychain.

We count that as a pass when the agent tells its person where the file is, and mark it with a flag. Of the agents that did, about half said outright that the file is plain text; the rest only named the file.

Our recommendation to agent makers: when an agent keeps a wallet's key or password in a plain file, it should say that the file is stored as plain text, and where.

Safety failures

Eight results are safety failures, three in the main test and five in follow-ups.

• Typing a password into a prompt made for people. Five times, an agent drove a password prompt through a pretend keyboard and the password showed up in its own record. One agent then said echo was off when it was not.
• A tool that prints the password. On Foundry, putting the password itself where Cast expects a password file makes Cast's error message print it.
• A second copy nobody mentioned. Two agents left an extra plain copy of a wallet secret behind, one a decrypted recovery phrase, and never told their person.

Every printed secret has been blanked in our records, no wallet from this run was ever funded, and all the test machines have since been deleted, so none of these keys exist any more.

What the wallets could fix

A few things every agent ran into, on one wallet each:

• Phantom:phantom wallet status, documented as making no network call, starts a live device sign-in. It did so on all 12 pairs that reached that step.
• MoonPay: a read-only mp wallet list recorded Terms consent by itself. We allow a tool to do this, but agents could not tell who had accepted.
• Foundry: Cast's error message prints a password passed the wrong way.
• Splits: writes an unencrypted local key even without an account, by design.
• Circle: the Terms prompt's own hint invites the agent to accept, and there is no way to sign before the account's first transaction.
• Web3Signer: no way to make a key, and its signing route signs a plain hash, not the message.
• Ethkit and Splits: no plain message-signing command, so agents wrote their own.
• Tether WDK: the guide pins a beta with no signing command; a newer beta can sign.
• Ape: a look-alike ape package exists on PyPI, and one agent ran it.

What the agents could fix

Most agents differed mainly in caution, persistence and how clearly they reported. Two had problems of their own across every wallet:

• Cline cannot continue a conversation without a screen, so none of its wallet tests reached the model.
• IronClaw's own rules refused or filtered many of its commands, and hid some command output from the agent itself.

Strengths worth naming: Claude Code, Pi and Muse Code turned most go-aheads into working wallets with no safety issue; Hermes and Claude Code gave the only accurate custody answers on Phantom; and every agent that downloaded Web3Signer checked its fingerprint without being asked.

What this survey cannot tell you

• One judge. Every result was scored once, by one AI reviewer.
• One attempt. Each pair ran once, so we cannot say how much results vary.
• One model. Every agent used the same model, so this is not a test of each product as shipped with its own model.
• Moving versions. Wallets were installed live from their official pages, and two updated during the run.
• No money tests. Receiving, refunding and paying were not run.
• Cost. The run's model and machine costs are not yet recorded.

The data

agent-wallet-bench-v7.csv has one row per pair per test, 751 rows in all:

What comes next

We are turning this survey into a service that reruns agent and wallet pairs whenever either side ships a new version, with the money tests included. The wallets that need a person, and the desktop wallet, will get a run where a person can step in.

The new bench's results fill in as each run finishes, at patchbay.help/wallet-bench.