On the afternoon of a routine trading day, Patrick Collison — co-founder of Stripe — published a set of post-acquisition growth figures for Privy, the embedded-wallet infrastructure company Stripe absorbed into its stack. The numbers read like a slide from an internal growth deck: wallet assets up approximately 25x, monthly active developers up approximately 3x, revenue up approximately 9x, and roughly $25 billion in monthly transaction volume. No audit trail was attached. No denominator was disclosed. No third party has verified a single figure. There was a founder, a platform, and four multiples.
That is the entire evidentiary baseline. My first instinct, after twenty-nine years of watching infrastructure claims get priced into markets, was not to ask whether the numbers were impressive. My instinct was to ask a narrower, more uncomfortable question. Twenty-five times what? Ninefold against which base? A $25 billion monthly run rate measured across which ledger, over which period, at which endpoint valuations?
The record shows that Privy issues no token. Stripe is not publicly listed. That means none of these four numbers can be traded, arbitraged, or settled against a market price. They exist only as narrative — and narrative is precisely the variable that rigorous comparison against primary sources is designed to filter out. Ledgers don't lie. Press cycles do. And this particular press cycle carried a detail buried near the end that most coverage omitted: the founder himself wrote that there is still a lot of integration work to do.
I spent six days reconstructing what these numbers can and cannot support. What follows is neither a celebration nor a takedown. It is a reconciliation.
Context: What Privy Is, What Stripe Is Buying, and Why the Category Matters
To understand what Collison's post actually signifies, you have to separate three things that mainstream coverage routinely collapses into a single headline: Privy the company, Stripe the acquirer, and Wallet-as-a-Service the category that both now occupy.
Privy's technical essence is not a chain. It is not a consensus mechanism. It is not a scaling solution. It is a wallet abstraction layer. It does not resolve the underlying problems of block space, finality, or throughput. What it does is package a specific set of operations — creating a wallet, managing private keys, initiating transactions, holding stablecoin balances, earning yield on those balances, moving fiat in and out, and spending via card — into a unified API sold to developers. Based on my audit experience with custody infrastructure, this places Privy squarely in the middleware and embedded-infrastructure category, not the protocol category.
The genuinely non-trivial engineering is the abstraction layer itself. Unifying stablecoin balances plus yield, fiat transfers, and card spending into a single integration means Privy must reconcile two separate ledger systems at once: on-chain (stablecoin) and off-chain (fiat and card-network clearing). The hard part of embedded finance is never cryptography. It is reconciliation and compliance orchestration. The technical barrier here is moderate. The compliance barrier and the distribution barrier are the real moats.
This distinction matters because the market tends to price crypto infrastructure as a monolithic bet. It is not. A wallet abstraction layer has a fundamentally different risk profile than a Layer 1 or a DeFi protocol. It carries no consensus risk, no validator-set risk, no token-inflation risk. What it carries instead is custodial trust risk, reconciliation risk, and regulatory risk — three exposures that are operational rather than cryptographic.
The timing of the disclosure is not accidental. Stripe has been executing a deliberate, multi-acquisition re-entry into crypto after a long public retreat. In 2018, Stripe stopped supporting Bitcoin payments, citing the technology's unsuitability for its business. The reversal since then has been methodical. Stripe acquired Bridge, a stablecoin infrastructure company, to handle the on-ramp and off-ramp layer. It acquired Privy to handle the wallet and account layer. The two acquisitions are not independent bets; they are interlocking pieces of a single architecture. Privy is the account layer. Bridge is the settlement and conversion layer. Stripe is the distribution and licensing layer.
Documentation confirms that Privy has been integrated into Stripe's Treasury, Link, and Connect product lines. This is the detail that changes the competitive analysis. Privy is no longer an independent WaaS vendor competing on technical merit. It has become the crypto account layer inside a payment giant with access to millions of merchants. That is a distribution moat that pure-play competitors cannot replicate by shipping better code.
The competitive set is crowded and, importantly, homogeneous. Fireblocks competes in institutional custody and multi-party-computation maturity. Coinbase's WaaS competes on ecosystem and compliance. Turnkey, Web3Auth, Dynamic, and Magic each occupy narrow slices of the embedded-wallet market. Based on my reconstruction of the field, the technical differentiation between these players is thin. What separates Privy is not the cryptography. It is the parent company.
The regulatory context frames everything. Privy issues no token. That single fact removes it from the Howey test's applicability entirely. There is no investment of money in a common enterprise, no expectation of profit derived from the efforts of others, because there is no token to sell. For a sector that has spent a decade litigating whether its assets are securities, this is a structurally clean position. But cleanliness on the securities axis does not mean cleanliness on every axis. Stablecoin regulation, stored-value regulation, and the entirely unsettled question of autonomous agent liability all sit directly in Privy's path.
There is one more piece of background that the disclosure implies but never states. Privy's early wallet architecture, like most of the embedded-wallet cohort, moved through a recognizable evolution: from multi-party computation key sharding toward secure-enclave and trusted-execution-environment designs. The direction of travel matters because it determines the trust model. In every variant, the user holds partial trust in the service provider. This is categorically different from a self-custody wallet, where the user holds the keys and the risk. The embedded in embedded wallet is not a marketing adjective. It is a description of where the trust sits.
That is the context. What follows is the forensic part: taking the four numbers apart.
Core: Decomposing the Four Multiples
Collison's post contains four quantitative claims and one qualitative admission. The four claims are wallet assets up approximately 25x, monthly active developers up approximately 3x, revenue up approximately 9x, and roughly $25 billion in monthly transaction volume. The admission is that significant integration work remains. I will take each in turn, because each fails differently — and because the way each fails tells you what the disclosure was optimized to show.
The 25x Wallet-Asset Claim Is Contaminated by Price Beta
This is the single most important number in the post and the one most likely to be misread. Wallet assets up 25x sounds like a statement about user adoption. It is not. It is a statement about the dollar value of assets held in Privy-powered wallets, which is a function of two independent variables multiplied together: the number of users and the price of the assets they hold.
Consider the arithmetic. If the measurement window spanned a broad crypto appreciation cycle, then a substantial portion of the 25x is not user growth at all. It is price beta — the mechanical revaluation of existing holdings as BTC and ETH rose. A user who held one Bitcoin through a fourfold price move contributes fourfold to the wallet assets figure without depositing a single additional dollar. Multiply that across a user base that may have grown two- to fourfold organically, and you can arrive at a headline of 25x while the underlying organic adoption is an order of magnitude smaller.
The record shows that the post provides no decomposition. It does not separate net new deposits from asset revaluation. It does not state the measurement dates at either endpoint. Without those two data points, the 25x figure is not a growth metric. It is an unadjusted gross figure that bundles at least two distinct phenomena — user acquisition and price movement — into a single, flattering number.
Based on my audit experience, this is the classic gross-versus-net problem. When I reconstructed the Terra collapse in 2022, the entire analytical exercise was separating mechanically inflated on-chain value from real economic flow. The same discipline applies here. A responsible disclosure of the 25x figure would include a constant-price, or same-store, restatement: what would the asset base be if prices had not moved? That restatement is absent, and its absence is the single largest analytical gap in the entire post.
Ledgers don't lie. But the way a ledger is aggregated can mislead, and a figure that multiplies user growth by price appreciation is an aggregation choice, not a lie. The distinction matters because the market will read 25x as adoption. The probability that it is substantially adoption, rather than substantially revaluation, is low.
The 9x Revenue Claim Has No Denominator
Revenue up 9x is the number that should attract the most scrutiny, precisely because it sounds the most concrete. Revenue is a dollar figure. It is not subject to price beta in the same way assets are. So it should be cleaner. It is not, for a different reason: it has no denominator.
A ninefold increase from a base of $1 million is a $9 million run rate. A ninefold increase from a base of $100 million is a $900 million run rate. These are different companies. The post does not disclose the base. Without the base, 9x is not a valuation input. It is a direction.
There is a second problem embedded in the revenue claim. If Privy's revenue is composed of a blend of B2B software subscription, transaction fees, and a share of stablecoin yield, then the 9x figure is not homogeneous. Some components are recurring and predictable. Some are cyclical and correlate directly with crypto market activity. The record shows no breakdown. A ninefold revenue increase driven by transaction fees during a high-activity period is a fundamentally different signal than a ninefold increase driven by contracted subscriptions.
I have seen this pattern before. During the 2020 DeFi Summer, I documented how yield figures presented as revenue for lending protocols were often a mix of genuine interest income and subsidized incentives, and the two behaved completely differently once the subsidies ended. The lesson generalizes. When a revenue figure is presented as a single multiple, the burden is on the discloser to show that the components share the same durability. Privy's disclosure does not meet that burden.
There is also an interest-rate sensitivity that almost no coverage has flagged. If a meaningful slice of Privy's revenue is a spread on stablecoin balances — the difference between what the stablecoin earns in a yield-bearing instrument and what is passed through to the user — then that slice is directly exposed to the rate environment. In a declining-rate regime, that spread compresses mechanically, independent of user growth. A ninefold revenue figure reported at a peak in rates may not be reproducible at a trough. Documentation confirms that the hold stablecoin balances and earn yield feature exists. Documentation does not confirm how the yield is sourced, who bears the rate risk, and how much of it Privy retains. Those are the questions that determine whether the 9x is durable or cyclical.
The 3x Developer Metric Is the Healthiest Signal and the Least Quantified
If I had to rank the four numbers by analytical quality, the developer metric would rank first. Monthly active developers up approximately 3x is the least susceptible to price contamination, because developers do not appear or disappear based on the price of BTC. A developer integrating an API is a decision about product, not a decision about portfolio. Developer count is therefore the closest thing in the post to a genuine adoption signal.
It is also the number that best captures Privy's actual moat. The developer is the entry point. Once a developer builds a wallet or account system on Privy's API, switching costs are high: migrating means rewriting the account architecture, re-integrating key management, and re-testing the entire flow. This is a developer lock-in effect, and it is the most durable form of stickiness in infrastructure. The 3x growth, if real, is evidence that the lock-in is compounding.
But here again the disclosure fails on quantification. Threefold from what base? A developer count that grew from a small cohort to three times a small cohort is not the same as one that grew from a substantial base to three times a substantial base. The post provides the multiple and withholds the magnitude. And unlike the asset figure, the developer figure cannot even be cross-checked against a market price, because developers are not a traded quantity.
There is a further ambiguity. Monthly active developer is an undefined term in this context. Does it mean a developer who made an API call? One who deployed to production? One who logged into a dashboard? The definition determines the meaning. A loose definition can inflate the count substantially. Based on my experience building audit tooling, the gap between registered developer and developer with a live integration is routinely an order of magnitude. The post does not specify which definition it uses.
So the developer metric is simultaneously the most meaningful and the most under-specified. That combination is characteristic of a disclosure optimized for impression rather than verification.
The $25 Billion Monthly Volume Is Real but Ambiguous
The $25 billion monthly transaction volume figure is the one that most directly implies scale. It is also the one whose meaning depends entirely on a definition that is not given.
Transaction volume in an embedded-wallet context can mean at least four different things. It can mean the gross value of all on-chain transfers initiated through Privy wallets. It can mean the net value of stablecoin balances moved. It can mean the value of fiat on-ramp and off-ramp flows. Or it can mean the total payment volume processed through the card-spending rail. These are not interchangeable. Gross on-chain transfer volume can be double-counted as funds move between wallets. Net settlement volume cannot. Fiat on-ramp volume and card-spending volume are different economic activities with different fee economics.
The record shows no definition. Without it, $25 billion per month is a headline, not a measurement. And because Privy sits between two ledgers — on-chain and off-chain — the risk of definitional inflation is structurally higher than for a single-ledger business. A payment processor's volume is unambiguous because it lives on one ledger. An abstraction layer that touches both can report a figure that flatters whichever framing it chooses.
I want to be precise here, because precision is the entire point. I am not claiming the figure is false. I am claiming it is unverifiable as stated, and that the burden of definition falls on the discloser. A $25 billion monthly figure with a clear definition would be a strong signal about stablecoin payment adoption. The same figure without a definition is a strong signal about nothing except the discloser's confidence that no one will ask.
The Absence of a Token Is a Shield on One Axis and a Wall on Another
It is worth dwelling on what is missing from the disclosure, because the most important structural fact about Privy is that it has no token. In a sector where nearly every infrastructure narrative is attached to a tradeable asset, Privy is an infrastructure company funded by equity and sold as a service. That absence has two consequences that point in opposite directions.
The shield is regulatory. No token means no securities offering, no Howey exposure, no token-sale compliance, no vesting cliff, no unlock schedule, no treasury runway to defend. The entire class of risk that has destroyed crypto projects — the mismatch between promised utility and realized value, the reflexive collapse when incentives dry up — does not apply. There is no peg to break because there is no peg. There is no emissions schedule to exhaust because there are no emissions. For an institutional customer like Klarna or Deel, this is not a limitation. It is a requirement. A regulated enterprise cannot build its account layer on a token whose legal status is contested. It can build on a licensed subsidiary of a payment company.
The wall is accessibility. Because there is no token, there is no direct way to hold exposure to Privy's growth. A retail investor who reads the 25x and wants to participate has no instrument. The only indirect routes are holding the tokens of Privy's customers — the most obvious being HYPE, given Hyperliquid's presence on the client list — or waiting for a Stripe public offering that has been speculated about for years but never confirmed. This is the structural irony of the disclosure: it reports the strongest growth figures in the embedded-wallet category, and almost none of that growth is investable through the asset class that reads the report.
I have watched this pattern repeat across the infrastructure layer. The most durable businesses in crypto are frequently the ones with no token, because they are forced to earn revenue rather than mint it. The absence of a token is a discipline. It also means the growth figures exist for the benefit of a valuation narrative, not a market price, which returns us to the central problem: unaudited, self-reported, and uninterrogated by the market mechanism that normally applies pressure to inflated numbers.
The Compliance Moat Is the Actual Asset
Step back from the four numbers, and the strategic picture is clearer than any of them. Privy's real asset is not its code and not its growth. It is the compliance and distribution infrastructure of its parent.
Stripe holds money-transmitter licenses across multiple U.S. states and payment licenses in numerous jurisdictions. It has established banking relationships and a mature compliance apparatus. That apparatus is what allows Privy to legally operate a mixed business — fiat plus stablecoin, on-chain plus off-chain — in a way that pure crypto-native WaaS vendors cannot. A competitor can replicate Privy's API in a quarter. A competitor cannot replicate Stripe's license portfolio in a quarter, or a year, or possibly ever, without buying the same kind of institution.
This is why the acquisition logic is sound and why the competitive framing is often wrong. The market tends to evaluate WaaS vendors on features. The actual competition is on regulatory surface area and distribution reach. On that axis, Privy's position is strong, and the strength is inherited rather than earned.
But the compliance moat cuts both ways. The same licenses that enable the business also expose it. The Link balance feature — which allows users to hold a balance within Stripe's ecosystem — edges toward stored-value and electronic-money territory. Once a user can hold a balance, regulators can reasonably ask whether that balance is a deposit, whether it is segregated, and whether the holder is a money transmitter for the purpose of that balance. These are not hypothetical questions. They are the standard questions, and the answers determine the license burden.
The stablecoin dimension adds a second layer. As stablecoin legislation advances — and it is advancing — the hold stablecoin balances and earn yield feature moves from a gray zone into a defined regulatory perimeter. Depending on how that perimeter is drawn, the yield feature may need to be structured so that the yield originates from a partner instrument rather than from Privy itself, to avoid being characterized as an unregistered investment product. Documentation confirms the feature exists. Documentation does not confirm the legal structure underneath it.
And then there is the newest and least settled exposure. If autonomous agents hold wallets, initiate transactions, and earn income, the question of liability is entirely unresolved. If an agent violates a sanctions rule or is used for laundering, the responsible party could be the developer, the user, or Privy. No jurisdiction has established precedent on the legal personhood of an autonomous agent. This is simultaneously the frontier of the technology and the deepest compliance gray zone in the entire architecture.
The Ecosystem Position: Why the Developer Entry Point Compounds
There is an ecosystem argument that the growth figures imply but do not make. Privy's position in the value chain is that of a two-way bridge — the layer that connects on-chain assets to off-chain payment and fiat. Above it sit the settlement layers, the stablecoin issuers, the card networks, and the banks. Below it sit the integrators: the on-ramp providers, the payroll and cross-border platforms, the buy-now-pay-later providers, and the trading venues.
The quality of the downstream client list is genuinely high. Klarna, Deel, Ramp, and Hyperliquid are each leaders in their respective categories. A client roster of that caliber is a strong ecosystem signal, because sophisticated buyers do not integrate infrastructure casually. But a strong client list is also a concentration risk in disguise. When a platform's growth is carried by a handful of large names, the loss of one relationship is a material event, and the disclosed figures do not tell us how much of the revenue sits in the top accounts.
The upstream dependency is equally important and less discussed. Privy's business model rests on stablecoin issuance and card-network rails that it does not control. If a stablecoin issuer changes its economics, or a card network changes its policy, or a bank partner changes its terms, the model is directly exposed. The moat is real, but it is a moat built on relationships with upstream institutions that hold their own leverage.
The compounding logic is the developer entry point. Every developer who integrates Privy's API deepens the lock-in and widens the surface area for adjacent products. That is why the 3x developer figure, despite its definitional problems, is the most strategically meaningful number in the post. It is the only figure that speaks to the durability of the position rather than the level of the current book.
The AI Agent Payment Narrative Is the Most Hyped and Least Verified
The most forward-looking element of the disclosure is the mention of AI agent payments — wallets held by autonomous agents that can transact and earn. Two early applications were named: Merit Systems and Nevermined. No scale data accompanied them. No transaction volumes. No user counts. No revenue contribution. The AI agent economy, as presented, is a narrative, not a metric.
This is exactly the pattern I spent 2026 dismantling. That year, I audited a decentralized AI compute marketplace that claimed to use blockchain for verification of AI model outputs. I demanded access to the smart contract logic that was supposed to verify those outputs, and I found a centralization flaw in the consensus mechanism that exposed the entire project as a traditional cloud service wearing Web3 branding. The valuation collapsed. The lesson was specific: when a project's most exciting claim is also its least verifiable claim, the excitement and the unverifiability are usually the same phenomenon.
The AI agent payment story has the same structural weakness. For an autonomous agent to hold a wallet and transact, three problems must be solved, and none of them are standardized. First, permission management: how does the agent's authority get bounded? Second, intent verification: how do you confirm the agent acted as intended and not as manipulated? Third, liability attribution: who is responsible when the agent errs? Based on my reconstruction of the space, the likely technical answers involve account abstraction, session keys, and spending limits — but none of these are settled standards, and the disclosure names none of them.
I want to be fair to the technology. The direction is real. An agent economy requires a payment rail that agents can use natively, and stablecoin accounts are a plausible answer. But there is a large distance between plausible answer and deployed infrastructure with measurable volume, and the disclosure jumps that distance in a single sentence. The prudent reading is that the AI agent economy is a standard-setting race, not a revenue line. Whoever defines how agents hold wallets and pay will control the next payment rail. That is a strategic motive, not a financial result.
Contrarian: What the Coverage Missed
Contrary to the press release's implicit framing, the most consequential fact in the disclosure is not any of the four numbers. It is the parent company's strategic reversal, and the integration that remains unfinished.
Start with the reversal. Stripe exited Bitcoin payments in 2018 and has now re-entered crypto through a sequence of acquisitions — Bridge for stablecoin settlement, Privy for wallet and account infrastructure. This is a larger signal than anything Privy itself reported. It means a top-tier payment company has concluded that stablecoin rails are strategically necessary, not optional. When an institution of Stripe's caliber reverses a public retreat, the reversal is the news. The growth multiples are supporting detail.
The second missed fact is the unfinished integration. The founder's own admission that there is still a lot of integration work to do is the most honest sentence in the post, and it reframes every number above it. If integration is incomplete, then some portion of the reported growth reflects pre-integration, standalone operation. Standalone growth during a period of market appreciation can look explosive and then decelerate once the easy gains are consolidated. The admission is a warning that the reported trajectory may not be the forward trajectory.
The third missed fact is what the disclosure is optimized for. A founder publishing high-growth numbers about a recently acquired subsidiary is serving multiple audiences at once: recruiting, brand, and — if the long-standing speculation about a Stripe public offering is accurate — a valuation narrative. I assign low confidence to the IPO motive specifically, but the general point holds. Self-reported figures from an interested party should be weighted differently than audited figures from a disinterested one, regardless of how trustworthy the party is. Patrick Collison's personal credibility is high. His numbers are still unaudited. Those two facts do not cancel. They coexist.
The fourth missed fact is the competitive risk that the growth story obscures. The embedded-wallet category is crowded with functionally similar products. Privy's differentiation is distribution and licensing, not technology. That is a durable advantage, but it is not the same as a technological moat, and it is vulnerable to a specific threat: the largest customers have the resources and the incentive to build in-house. Klarna, Deel, Ramp, and Hyperliquid are all sophisticated enough to eventually reduce their dependence on a single supplier. The higher the customer concentration, the more acute this medium-term disintermediation risk becomes. The disclosure names impressive customers. It does not disclose how concentrated the revenue is among them.
There is a fifth angle that almost no one will write about because it is not flattering to either side. The mention of early AI agent applications may carry an element of ecosystem mutual-promotion. When a platform names two early partners in a growth announcement, the relationship between the platform and those partners is rarely clarified. It could be commercial. It could involve investment. The record shows no clarification. In the absence of clarification, the prudent analyst treats named-but-unquantified partners as marketing, not as evidence.
Finally, consider the transmission to the wider market, because it is where the disclosure's real economic footprint sits. If $25 billion in monthly volume flows through Privy-powered accounts and settles primarily in stablecoins, then the demand-side beneficiary is the stablecoin issuer, not Privy's own investors. The trading venues on the client list benefit from smoother on-ramps. The traditional cross-border payment businesses face a long-horizon substitution pressure as stablecoin rails route around correspondent banking. And the wallet-infrastructure category itself gets a comparable-valuation catalyst, which cuts both ways: it validates the business model and it invites more competition into a field that is already homogeneous. The disclosure is, in effect, a signal about the stablecoin settlement layer wearing the costume of a wallet-growth story.
Takeaway: What to Watch Next
The four numbers are a snapshot. The forward-looking questions are more useful.
Watch whether Privy or Stripe ever publishes a constant-price restatement of the asset figure. If the 25x survives a same-store adjustment, the adoption story is real. If it does not, the number was price beta all along, and the market will eventually figure that out on its own timeline.
Watch the revenue base. If a subsequent disclosure gives an absolute revenue figure rather than a multiple, the 9x becomes interpretable. Until then, it is a direction, not a value.
Watch the interest-rate exposure. If a meaningful portion of revenue is a spread on stablecoin balances, the next rate-decline cycle will reveal how much of the growth was structural and how much was a rate artifact.
Watch the AI agent rail. The question is not whether agents will hold wallets. The question is which standard they will use, and whether Privy defines it or merely participates in it. A platform that sets the standard captures the rail. A platform that follows it captures a fee.
And watch the integration completion. The single most honest data point in the entire disclosure is the admission that work remains. When that work is done, the reported numbers will either confirm the trajectory or expose it as a pre-consolidation artifact.
Ledgers don't lie. Neither do integration timelines. The rest is a matter of waiting for the audit that no interested party has volunteered.