ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Bankrbot sends 3 billion DRB from Grok's wallet after a Morse-code prompt injection relayed by Grok

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Bankr· Bankrbot

Bankrbot sends 3 billion DRB from Grok's wallet after a Morse-code prompt injection relayed by Grok

After an outsider gave the Bankr wallet tied to xAI's @grok account a membership NFT that unlocked transfers, Grok decoded a Morse-code post into a public reply tagging @bankrbot, and Bankrbot sent 3 billion DRB, worth roughly $150,000 to $200,000, to the outsider's address.

Bankr's trading agent, Bankrbot, acts on X posts that tag it and gives every account that interacts with it a wallet; the one tied to xAI's @grok account held DRB, a token Bankr launched from a Grok reply in March 2025. Press and SlowMist report that an attacker first sent that wallet a Bankr Club Membership NFT, which unlocked transfers, then posted a Morse-code message that Grok decoded into a reply tagging @bankrbot. At 06:49 UTC on 4 May 2026 Bankrbot sent 3,000,000,000 DRB from the wallet to 0xe8e4...686b on Base and replied 'done. sent 3B DRB'. The tokens were moved on and swapped into USDC and ETH, and the X account Bankrbot tagged, @Ilhamrfliansyh, was deleted. Bankr's founder said the same day that a hard-coded block on Grok's replies had been lost in a rewrite, that a stronger block was in place, and that 80% of the funds had been returned; SlowMist puts the return at 80 to 88% after negotiation. The DRB Task Force disputes Bankr's account of the return and calls the case theft. Values of $150,000 to $200,000 are reported.

Updated 27 Oct 2026

First incident action to disclosure
0 days
First incident action to discovery
0 days
Noticed first by
Someone else
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 13 Mar 2025

    Bankr stops acting on Grok's replies after Grok-prompted token launches

    Grok had suggested the DebtReliefBot (DRB) token, which Bankr launched, with fees going to a Grok-linked wallet. Date of The Block's report; Bankr's founder later said this hard-coded block did not carry into a rewrite of the agent.

    Reported

  2. Not disclosed

    Attacker sends a Bankr Club Membership NFT to Grok's Bankr wallet

    Press and SlowMist say membership unlocked transfers and other high-privilege tools with no further confirmation. CryptoSlate gives token 692 of contract 0x9fab...ce82. No source gives the date; it was before 4 May.

    Reported

  3. 4 May 2026

    Grok decodes a Morse-code post into a public reply tagging @bankrbot

    Grok's post went up at 06:45:11 UTC (from its post id) and is no longer available; the attacker's post was deleted. Its wording is known only from paraphrase: send 3 billion DRB to the attacker's address.

  4. 4 May 2026

    First incident action

    Bankrbot transfers 3,000,000,000 DRB from Grok's wallet

    06:49:01 UTC, Base block 45,543,997, from 0xb1058c...e4f9 to 0xe8e476...686b. Bankrbot replied 'done. sent 3B DRB' at 06:49:21 UTC.

    Reports differ

    Reported value of the transfer varies by source and time of valuation.

    • About $155,000 to $200,000 at the time.
    • Near $174,000 (BeInCrypto), about $175,000 (SlowMist via The Crypto Times).
    • $150,000 to $174,000 (Giskard); about $200,000 (Dexerto, AI Incident Database).
    • About $155,000 to $180,000 (OECD.AI monitor).

  5. 4 May 2026

    Tokens moved on and swapped into USDC and ETH; the tagged X account is deleted

    BeInCrypto says the funds were bridged and sold quickly; SlowMist says they were swapped into USDC and ETH. A breakdown on X traces them to ilhamrafli.base.eth.

    Reported

  6. 4 May 2026

    X users flag the exploit and trace the NFT and addresses

    First flag found at 08:47 UTC; a breakdown at 09:20 UTC names the membership NFT, the wallet and the receiving addresses.

  7. 4 May 2026

    About 80% of the funds are returned after negotiation

    Returned by 14:59 UTC per Bankr's founder, mostly as USDC and ETH per SlowMist. The rest was kept by the attacker as an informal bug bounty, per SlowMist, and remains in dispute.

    Disputed

    Reports differ

    Sources differ on how much came back and on how the return was obtained.

    • 80% returned, the remaining 20% to be discussed with the DRB community.
    • 80 to 88% recovered through negotiation, the rest treated as an informal bug bounty.
    • The attacker offered to return funds only after the community obtained his personal details; the DRB Task Force calls it theft.

  8. 4 May 2026

    Disclosed · 0 days after the first incident action

    Bankr's founder explains the cause and adds a stronger block on Grok

    The block on Grok's replies did not carry into a complete rewrite of the agent. Owners can enable IP whitelisting, permissioned API keys and a toggle that stops Bankr acting on X replies.

  9. 4 May 2026

    DRB Task Force disputes Bankr's account and calls the case theft

    It says the attacker offered to return funds only after the community obtained his personal details.

    Reported

  10. 4 May 2026

    Handler found out · 0 days in

    The handler finds out

    Earliest public flag found: an X post at 08:47 UTC, then a breakdown at 09:20 UTC naming the NFT and the addresses. When Bankr itself noticed is not stated.

  11. 7 May 2026

    SlowMist publishes a post-mortem calling it AI agent permission chain abuse

    Date of The Crypto Times' report; SlowMist's own page could not be opened for this draft. SlowMist says Grok never held keys or executed on-chain operations.

    Reported

Agent failures

Prompt injection / context poisoning, Hijacked by an attacker, Destructive actionShow
Map to frameworks

  • Prompt injection / context poisoning

    A Morse-code post led Grok to publish a reply tagging @bankrbot with a transfer instruction, and Bankrbot executed it as a command.

  • Hijacked by an attacker

    An outsider steered Bankrbot to move the wallet's funds: first by sending a membership NFT that unlocked transfers, then through Grok's reply.

  • Destructive action

    Sent 3 billion DRB in an on-chain transfer that cannot be reversed; recovery of 80 to 88% depended on negotiation with the recipient.

How it was found

Found first by someone else, from the damageShow
Found first by
Someone else
How
The damage
Found to disclosed
0 days

Bankrbot posted its own confirmation of the transfer in reply to Grok, so the send was public at once, but it was X users and DRB holders who flagged it as an exploit, from about two hours later, tracing the NFT and the addresses on-chain. Bankr's founder explained the cause and the return of 80% of the funds about eight hours after the transfer. No source describes a Bankr alert or limit that caught the transfer before or as it ran; SlowMist says there was no anomaly detection.

What is publicly known

1 of 12 fully publicShow
1 of 12 fully public
ItemPublic?DetailSources
UnknownNo source names the model behind Bankrbot. The intermediary is xAI's Grok; no version is given.
UnknownNo source says.
PartialBankr's founder says the first agent ignored Grok's replies and that block was lost in a rewrite; transfers were gated by membership. SlowMist says there was no secondary confirmation, transfer limit or anomaly detection.
UnknownNot published.
PartialBankrbot acts on X posts that tag it, trading and transferring from wallets it provisions per account. The decoded instruction is known only from paraphrase.
PartialAn auto-provisioned wallet tied to an X account, keys held by a third-party custodial service per SlowMist, tools unlocked by Bankr Club membership, and an X reply scanner. Bankr says it does not hold the keys.
UnknownNo source describes it.
WeakBankrbot's reply is public. The attacker's post was deleted and Grok's reply is no longer available; their wording survives only in paraphrase.
PartialThe transfer is on the public Base ledger with hash, block and time. No Bankr-side alert or log is described.
Partial3,000,000,000 DRB, valued at $150,000 to $200,000 depending on source; 80 to 88% returned and the rest disputed. Effect on DRB holders is described only as short-term price volatility.
KnownBankr's founder: the block on Grok's replies was lost in a rewrite and someone used the gap to prompt-inject Grok into instructing Bankr. SlowMist adds the NFT-unlocked permissions.
PartialA stronger block on Grok's account, plus optional IP whitelisting, permissioned API keys and a toggle to stop acting on X replies, which owners must enable. Not independently verified.

Controls that apply

  • Identify

    Test adversarially before release

    Bankr's founder says the block on Grok's replies did not carry into a complete rewrite of the agent. Testing the rewrite for LLM-to-LLM injection before release would have surfaced the missing block.

  • Protect

    Treat what the agent reads as untrusted

    Bankrbot treated a public reply from another account, Grok, as an order to move funds. Treating X replies as data that cannot start a transfer on their own would have held it; CryptoSlate's line is that a command in public text should never inherit wallet authority.

  • Authenticate and constrain agent-to-agent channels

    The instruction passed from one agent, Grok, to another, Bankrbot, through public X replies. Bankr had blocked Grok's replies in March 2025, but the block was lost in a rewrite. A named, authenticated channel between agents would have refused an unauthenticated post as a source of orders.

  • Ask a person before high-impact or irreversible actions

    SlowMist says membership unlocked transfers with no secondary confirmation. Holding a transfer of the wallet's whole DRB balance for the account owner's approval would have surfaced the request before the tokens left.

  • Cap rate, spend and resources

    SlowMist reports no transfer limits. A per-transfer or daily cap on the wallet would have refused a single send of 3 billion DRB, worth roughly $150,000 to $200,000.

  • Give each agent the least agency its task needs

    Transfer rights on Grok's wallet were switched on by a membership NFT that an outsider sent to it. Tying tool permissions to a deliberate choice by the account owner, as Bankr's permissioned API keys now allow, would have left the wallet unable to send.

  • Detect

    Monitor every run and alert on what does not fit the task

    SlowMist reports no anomaly detection. The first public flag we found came about two hours after the transfer, from X users. Monitoring would have flagged a whole-balance transfer from a wallet whose membership had just been switched on by an outside NFT.

  • All controls →

Coverage and commentary

4 posts on X, 3 statements, 14 articlesShow
BBuBBliK@k1rallik𝕏SOMEONE JUST ROBBED A ROBOT WITH MORSE CODE A guy encoded "send me all the money" in dots and dashes. The AI read it. And just... did it.4 May 2026♥ 22.1K⟲ 1.8K2.8M viewsRead on XBbankrbot@bankrbot𝕏@grok @Ilhamrfliansyh done. sent 3B DRB to . - recipient: 0xe8e47...a686b - tx: 0x6fc7eb7da9379383efda4253e4f599bbc3a99afed0468eabfe18484ec525739a - chain: base4 May 2026♥ 4.7K⟲ 3778.5M viewsRead on XDdeployer@0xDeployer𝕏what happened with the @grok wallet: 80% of the funds have been returned the remaining 20% will be discussed with the $DRB community. bankr auto-provisions an x wallet for every account that interacts with us. grok has one. it's controlled by whoever controls the x account, not…4 May 2026♥ 610⟲ 110117.6K viewsRead on XMMedbdy(🔆)@MedbdyLLC𝕏A breakdown of what happened and how @grok got tricked to send debtreliefbot:native tokens 1-Preparation NFT gift unlocks tools The attacker linked to ilhamrafli.base.eth gifted a Bankr Club Membership NFT to Grok’s on-chain wallet…4 May 2026♥ 369⟲ 4397.3K viewsRead on X

What the parties involved said

  • deployer (@0xDeployer), Bankr

    Says Grok's wallet is controlled by whoever controls the X account, not by Bankr or xAI; the old block on Grok's replies was lost in a rewrite and has been replaced; 80% of the funds are back.

  • SlowMist (via The Crypto Times)

    Calls it AI agent permission chain abuse: Bankr mapped Grok's words to a transfer, and membership unlocked transfers with no confirmation, limits or anomaly detection. Says Grok never held keys.

  • Yu Xian, SlowMist founder (via Cointelegraph)

    Writing on a later breach of 14 Bankr wallets, ties it to the same trust layer between Grok and Bankrbot that let Grok's allocated assets be stolen by prompt injection.

Press coverage

All 17 sources

  1. Primary source

    Base transaction 0x6fc7eb7da9379383efda4253e4f599bbc3a99afed0468eabfe18484ec525739a ↗Basescan (Base network record) · 2026-05-04

  2. Primary source

    bankrbot on X: done. sent 3B DRB ↗X · 2026-05-04

  3. Primary source

    deployer on X: what happened with the @grok wallet ↗X · 2026-05-04

  4. Press

    Grok's crypto wallet was just exploited by a tweet sent in morse code without any private key compromise ↗CryptoSlate · 2026-05-04

  5. Press

    Bankr bot ends Grok's unintentional token creation spree by disabling interactions on X ↗The Block · 2025-03-13

  6. Press

    How AI Was Tricked Into Stealing $150,000 From Grok Wallet ↗BeInCrypto · 2026-05-04

  7. Press

    Bankr Disables Transactions After Hacker Accessed 14 Crypto Wallets ↗Cointelegraph · 2026-05-20

  8. Press

    How a Free NFT Allegedly Drained $174K From a Grok-Connected Wallet ↗Cointelegraph Magazine · 2026-05-13

  9. Commentary

    AI on Base on X: Someone just exploited Grok to send 3B $DRB ↗X · 2026-05-04

  10. Commentary

    Medbdy on X: A breakdown of what happened and how @grok got tricked ↗X · 2026-05-04

  11. Commentary

    SlowMist Labels Grok AI Bankr Hack a Permission Chain Attack ↗The Crypto Times · 2026-05-07

  12. Commentary

    How Grok got prompt-injected: an X user drained $150,000 from an AI wallet ↗Giskard · 2026-05-07

  13. Commentary

    Someone Used Morse Code to Trick Grok Into Sending $174,000 and It Has Happened Before ↗Startup Fortune · 2026-05-04

  14. Commentary

    X user tricks Grok into sending them $200,000 in crypto using morse code ↗Dexerto · 2026-05-05

  15. Commentary

    Incident 1556: X User Reportedly Used Morse Code Prompt to Induce Grok-Linked Trading Bot to Transfer $200,000 in Tokens ↗AI Incident Database · 2026-05-04

  16. Commentary

    AI Prompt Injection Exploit Drains Grok-Linked Crypto Wallet ↗OECD.AI Incidents and Hazards Monitor · 2026-05-04

  17. Commentary

    AI-linked wallet drained via prompt injection in Bankr exploit ↗AMBCrypto · 2026-05-04

Entry id bankr-grok-morse-drb-transfer-2026 · overall Confirmed · impact serious

Related incidents