On-chain, usually not: a confirmed blockchain transaction cannot be reversed by you, the agent or the platform that runs it. When an agent sent about $250,000 in tokens to a stranger by mistake in February 2026, the tokens were reported sold within about 15 minutes. Getting money back depends on someone choosing to help: the recipient, the platform, or, for some regulated stablecoins, an issuer acting on a lawful order.
A note on the legal and regulatory points here: they summarise public sources as of November 2026 and should not be relied on. Rules for AI agents are still being written, and some of what is described here is proposed or coming soon rather than settled. Check the current position, or ask a qualified professional, before acting on it. Incident details are as publicly reported at the time, and some are disputed.
Why can’t a blockchain transaction just be undone?
A blockchain transaction cannot be undone because no one has the power to undo it. Once a transfer is confirmed, it is part of a shared record that many independent computers agree on, and there is no central operator to call.
That is very different from a card payment. As a US state banking regulator’s guide to crypto risks puts it, crypto payments typically cannot be reversed. It adds that they do not come with the legal protections that credit and debit cards carry. In practice, you usually get money back only if the person you paid sends it back.
An AI agent does not change any of this. It signs with the same keys a person would. If the agent signs the wrong amount or the wrong address, the network sees a valid transaction and settles it.
What an agent does change is speed and scale. A person usually pauses before sending a large sum. An agent with authority to send will do it in seconds, and can repeat the error across many transactions before anyone notices. That is why the safeguards in this guide sit before the transfer, not after it.
What happened in the real cases?
Two widely reported agent failures of 2026 ended very differently, and the difference had nothing to do with the blockchain. In one, the money was gone. In the other, the platform promised to pay users back out of its own pocket.
| February 2026: the mistaken transfer | May 2026: the compromised wallets | |
|---|---|---|
| What happened | An autonomous trading bot, by its own account three days old, was asked by a stranger for a small tip. It sent about 5% of a token’s total supply instead. | An AI trading assistant reported that an attacker had accessed 14 user wallets on its platform. |
| Reported value | About $250,000 at the time of the transfer | Estimates ranged from at least $170,000 to about $440,000, depending on the source |
| Cause | Disputed. Early observers suggested a misread raw amount that inflated the transfer a thousandfold. The developer’s own account, as reported, blamed a memory failure after a crash. Neither has been independently confirmed. | Disputed. One security researcher described a social-engineering attack on the link between two automated agents; others said the cause was unclear pending a review. |
| Outcome | The recipient was reported to have sold the tokens within about 15 minutes. No recovery was reported. | The platform paused transfers and swaps and pledged to reimburse all lost funds. Completion had not been confirmed in the reports we read. |
Two lessons stand out. First, speed: the tokens in the first case were sold in minutes, long before anyone could react. Second, the only route back in the second case was a business decision by the platform, not a feature of the chain.
So who could actually make me whole?
Four parties can sometimes help, and none of them is obliged to by the blockchain itself. Which ones apply depends on where the money went and who holds it.
The recipient. If the funds landed with an honest person, or an exchange account that can identify its customer, asking them is the first step. Sometimes it works. In the February case, it did not.
The platform that ran the agent. Some platforms compensate users after a failure, as the May case shows. That is a choice, shaped by their terms of service, their balance sheet and their reputation. Read those terms before you fund an agent, not after.
A stablecoin issuer. Some stablecoins, digital tokens pegged to a currency such as the dollar, can be frozen by the company that issues them. The GENIUS Act, the US stablecoin law enacted as Public Law 119-27 in July 2025, lets regulated issuers issue only if they can technically comply with lawful orders. Those orders can require an issuer to seize, freeze, burn or block transfers of its stablecoins. A freeze is a tool for legal processes, not a refund desk.
Law enforcement. If the loss came from theft or fraud, report it. The CFTC’s advisory on AI trading scams points victims to the CFTC and the FBI’s internet crime reporting service. A report creates a record, which matters if funds are later traced or frozen.
What should I do in the first hour?
Act fast, because the window in which anything can be done is short. In the February case, the tokens were reported sold within about 15 minutes of the transfer. Stop the agent first, then protect what is left, then document.
- Stop the agent. Pause it, revoke its API keys and cancel any spending permissions or token approvals it holds. An agent that made one bad transfer can make another.
- Move what remains. If you suspect a compromise, create a new wallet with a new seed phrase, the backup words that control it, on a clean device, and move remaining funds there. This was the platform’s own advice in the May case.
- Record everything. Save transaction hashes, addresses, times, amounts and the agent’s logs. A hash is the unique ID of a transaction.
- Contact the recipient side. If funds went to an exchange deposit address, contact that exchange with the hash. If they went to a regulated stablecoin, contact the issuer.
- Report it. File with the relevant authorities and keep the reference numbers.
- Ignore paid “recovery” offers. In our view, anyone who contacts you promising to recover crypto for an upfront fee should be treated as a likely second scam.
What could go wrong?
The hardest part is often working out what kind of failure you had, because that decides who, if anyone, pays. A mistake, a hack and an agent that was tricked can all look the same on-chain: funds left, and they did not come back.
The May case shows the problem. The platform called it a sophisticated social-engineering attempt. One analysis, citing a security researcher, pointed to hidden instructions that one agent decoded and another obeyed. Others suggested the weakness might lie elsewhere. Each explanation points responsibility in a different direction.
There is also a quieter risk. Many people assume a platform will cover them because one platform once did. Compensation is not a standard, and the money ultimately comes from someone’s balance sheet. Where liability sits when an agent loses money is still largely unsettled, which is the subject of the next series.
The trust takeaway
Treat every agent transfer as final, because on-chain it is. The protection has to come before the transaction, not after it.
Before funding an agent that can send money, check or ask:
- Can it send only to an allowlist of addresses you approved?
- Is there a per-transaction cap, and does it ask you above a set amount?
- Does the platform publish a written policy on what it covers if the agent fails?
- Can you pause it and revoke its permissions in one step?
- Does it keep a log of every transfer and the reason for it?
- Are you holding only what you can afford to lose in the agent’s wallet?