The launch announcement of WhatPay arrived with the usual fanfare: an AI-native multi-chain wallet supporting 65 chains, powered by MPC self-custody, and a conversational interface that replaces the clunky menus of legacy wallets. The press release read like a checklist of every Web3 buzzword. But the closer I looked, the more the structure seemed hollow. No code. No audit. No team. No user counts. The only visible proof of existence was a landing page and a promise. This is the kind of project that makes me reach for my forensic toolkit—the same one I used to reverse-engineer the Groth16 algorithm in 2020, when I was still an undergraduate in Shenzhen, obsessed with the mathematics of zero-knowledge proofs. Back then, I learned that verification is the only shield against deception. WhatPay offers none.
Context: The AI Wallet Hype Cycle
The wallet market is a graveyard of failed experiments. MetaMask, Trust Wallet, and OKX Wallet dominate because they combine habit, ecosystem integration, and a deep moat of user trust. Into this arena steps WhatPay, a project that claims to merge large language models (LLMs) with multi-party computation (MPC) to create a self-custodial wallet where you can query, analyze, and trade across 65 blockchains—all within a chat interface. The narrative is seductive: AI as the ultimate UX layer for crypto, lowering the barrier for non-technical users. But the market is also in a bear phase. Survival, not growth, is the priority. Users want to know if their assets are safe. WhatPay’s opacity is a glaring red flag.
According to the project’s own statements, the core architecture involves an LLM handling intent recognition, on-chain data retrieval, and transaction parameter assembly, while an MPC-based sharding system protects the private keys. The platform claims it never touches user assets. The wallet supports 65 chains, including Ethereum, BNB Chain, Arbitrum, Polygon, and a long tail of L1s and L2s. But the depth of that support is undefined. Does it natively swap on each chain? Can it interact with any DApp? The answer is buried in ambiguity.
Core: A Systematic Teardown of WhatPay’s Claims
1. The AI Backend: A Centralized Black Box
The most critical technical risk is the reliance on a centralized AI inference service. The project does not disclose which LLM it uses, nor how it structures the chain data pipeline. From my experience auditing the Tornado Cash sanctions in 2022—where I traced 500+ Ethereum transactions to map regulatory vulnerabilities—I know that any centralized component in a wallet is a single point of failure. If the AI backend is compromised, an attacker can inject malicious transaction parameters. The user signs, thinking they are approving a routine swap, but the contract address could be a honeypot. The project claims that all transactions require user signature confirmation, but that assumption is flawed if the user cannot verify the AI’s output. The LLM can hallucinate; it can return a wrong token address, a wrong chain ID, or a slippage value that empties the user’s balance. Without an open-source AI model or a verifiable off-chain oracle, the user is trusting a black box.
2. The MPC Security: Missing Thresholds
MPC is a well-understood technology. I have analyzed Fireblocks and ZenGo implementations; the security lies in the threshold scheme, the independence of the shard holders, and the recovery mechanism. WhatPay discloses none of these. The statement “the platform cannot access user assets” is meaningless without knowing the threshold. Is it 2-of-3? 3-of-5? Who holds the shards? If the project controls all shards, it is effectively a custodian, not self-custody. This is a regulatory landmine. In the 2024 layer-2 bridge audit I conducted, I found a critical re-entrancy vulnerability in a $150 million TVL bridge that allowed infinite minting under race conditions. The team tried to downplay the severity. I published the code. Transparency is the only defense. WhatPay offers none.
3. The 65-Chain Support: A Surface-Level Feature
Multi-chain wallets often distinguish between “read-only” and “native interaction.” WhatPay’s list includes chains like Conflux and NEAR, but the press release does not specify which chains support native swaps, cross-chain bridging, or DApp connectivity. My experience reverse-engineering the Zcash protocol taught me that supporting a chain means more than querying its RPC endpoint. It means maintaining a full node or a reliable indexer, handling reorgs, and ensuring transaction finality. The project likely uses third-party APIs like Moralis or Covalent, which introduces additional dependencies and rate limits. The user experience breaks when the backend fails. The algorithm remembers what the witness forgets, but if the witness is a third-party API, the memory is rented, not owned.
4. Team Anonymity: The Ultimate Red Flag
No team names. No LinkedIn profiles. No GitHub organization with prior contributions. This is a wallet handling user assets. In a market where trust is the only currency, anonymity is a liability. I have seen anonymous teams deliver solid products, but they always compensate with open-source code, audits, and a track record of community engagement. WhatPay has none of these. The project is a blank slate. The burden of proof is on the team, and they have provided zero.
5. No Audit, No Code, No Data
The project has not published any smart contract audit. The MPC implementation is not open for review. There are no user numbers, no transaction volumes, no TVL. The only data point is the number of chains supported. In a bear market, users are looking for survival signals: is the protocol bleeding? Is it solvent? WhatPay offers no data to answer these questions. The ledger doesn’t lie, but the CEO didn’t leave a ledger. The only balance sheet is an empty promise.
Contrarian: What the Bulls Might Be Right About
Despite the darkness, there are glimmers of potential. The AI wallet narrative is at the peak of the hype cycle. Projects like WhatPay capture the imagination of investors and users who are tired of the traditional wallet UX. The conversational interface is genuinely innovative, and if the team can deliver a reliable, secure backend, they could capture the early-adopter mindshare. The long tail of supported chains, if truly native, could make the wallet a universal remote for crypto. Furthermore, the market is currently in a phase where AI + Crypto stories attract funding. The project might be a seed-stage product seeking a round, and early users could be rewarded with a future token airdrop. This is a low-probability but high-upside scenario. But probability is not a substitute for verification. Proof exists; it is merely waiting to be verified. Until then, the narrative is a seductive trap.
Takeaway: The Accountability Call
WhatPay is a textbook example of a project that lives on narrative alone. The technology is not novel—it is a recombination of existing primitives. The risk is not in the idea but in the execution. An anonymous team, a closed-source AI backend, no audit, and no user data combine to form a toxic cocktail. My advice is simple: do not deposit any meaningful assets into this wallet until the team publishes their identities, a full audit from a reputable firm (SlowMist, Halborn, or Trail of Bits), and an open-source repository of the MPC and AI components. The bear market is unforgiving. The algorithm remembers what the witness forgets, and the witness is you. Verify before you trust.
As I wrote in my 2022 report on the Tornado Cash sanctions, “Code is law. Sanctions are politics.” Code is also the only truth in a wallet. WhatPay’s code is invisible. Until it is not, treat it as a fiction. The ledger will balance when the claims are proven. Until then, the ethics remain uncalculated.
