The code does not lie. Only the auditors do. But when there is no code to audit, and no auditors to speak of, the only truth left is the silence of an anonymous team.
I spent six weeks in 2017 dissecting the smart contracts of 'Ethereum Gold,' a project that raised $12 million before an integer overflow drained its treasury. That experience taught me one thing: marketing hype is a cipher, and the only key is on-chain evidence. Last week, I dove into the public materials of WhatPay, an AI-native multi-chain wallet that claims to let you 'converse your way to trading.' Its pitch is seductive: natural language queries, MPC self-custody, 65 chains supported. But after reading the project's own disclosures, I found a ledger filled with red flags, not transactions.
Let me state this clearly: WhatPay is an early-stage product announcement dressed as a revolution. Its core innovation is an interaction layer—replacing menu clicks with LLM chat. That is not a breakthrough in cryptography or consensus; it is a UX tweak. And without independent verification, that tweak might be a trap.
Context: The Hype and the Holes
The project positions itself as an 'AI-native multi-chain wallet' using MPC (Multi-Party Computation) to shard private keys, plus a large language model to parse user intent. According to its official materials, it supports 65 public chains and Layer 2s, from Ethereum to Conflux. It claims to be 'live,' but no testnet, audit report, or third-party review has been published. The team is fully anonymous. No tokenomics, no user count, no trading volume—just a list of features and a promise.
This is the standard playbook for a seed-stage project riding the 'AI + Crypto' narrative. But wallets are not capricious altcoins; they are custodians of user funds. The burden of proof is higher.
Core: Systematic Teardown
Let me walk through the technical claims one by one, because the devil is in the missing details.
MPC Self-Custody: A Mature Road, But No Map
MPC is a well-known technique used by Fireblocks and ZenGo. The idea is to split the private key into shards distributed across multiple parties, so no single entity can sign alone. But WhatPay does not disclose the threshold (e.g., 2-of-3, 3-of-5), who holds the shards, or how recovery works. Without this, 'self-custody' is a keyword, not a guarantee. In my experience auditing DeFi protocols in 2020, the absence of such details often meant the team hadn't finalized the architecture. I flag this as a high-risk unknown.
AI Intent Recognition: The Black Box
The official description says the AI 'automatically completes intent recognition, data retrieval, and result generation.' But which LLM is used? How does it handle structured on-chain data—via indexed RPCs, GraphQL, or something else? The biggest risk is hallucination: the AI could return a wrong token address, incorrect slippage, or a malicious contract disguised as a legitimate one. Users must sign every transaction, but if the AI outputs a plausible-looking address, the user has no way to verify it. This creates a new attack surface: compromise the AI backend, and you can trick users into signing anything. I call this 'conversation-as-exploit.'
65 Chains: Support Depth Unknown
'Supporting 65 chains' is a classic marketing trick. It could mean native swaps on all chains, or just read-only balance display. The materials list the chain names but give no granularity. Based on my work tracing wash trading on NFT marketplaces in 2021, I know that 'multi-chain' often means 'one chain works well, the rest are afterthoughts.' Until I see transaction hashes on Arbitrum, Polygon, and Celo, I treat this claim as vanity.
Tokenomics: Zero Data
There is no token, no fee structure, no incentive plan. This is not a red flag per se—many wallets start without a token. But it means the project has no clear value capture mechanism. If a token is released later, it will likely be pure speculation, not backed by actual revenue. I have seen this pattern in the 2022 bear market: projects launch a token, pump it on hype, then dump as the narrative fades.
Team: The Loudest Silence
No team names, no LinkedIn profiles, no investors. For a wallet that manages user assets, this is the biggest red flag. Trust is not a smart contract; it is built on reputation. Anonymous teams can work for privacy coins, but for a wallet, transparency is a prerequisite.
Contrarian: What the Bulls Might Get Right
Despite the risks, the 'AI wallet' narrative is timely. If WhatPay can capture the early user base and build a moat—perhaps through a unique data flywheel or a token airdrop that rewards early adopters—it could become a legitimate player. The market is starving for a user-friendly entry point into DeFi, and AI chat could be that bridge. I have seen lesser projects succeed on timing alone. But the probability is low.
More importantly, the project's existence signals a shift in the wallet landscape. Even if WhatPay fails, the conversation it starts may force incumbents like MetaMask and OKX to integrate AI features. This is a minor positive externality, but it does not make WhatPay a safe investment.
Takeaway: Verify, Don't Trust
"I trace the flow; you trace the lies." My advice: do not store any significant assets in WhatPay until the team reveals itself and publishes a security audit by a reputable firm like Halborn or Trail of Bits. If you must test the experience, use a burner wallet with a few dollars. And always, always double-check the transaction details before signing—the AI may be wrong, and the silence of the code will not protect you.
Promises are encrypted; data is decrypted. The on-chain evidence for WhatPay is still empty. I will wait until it fills.