What happened

Bankr is a service that executes crypto transfers when a wallet’s owner tells it to on X. “Every X account that interacts with Bankr gets auto-provisioned a wallet,” Bankr says. One of those wallets was tied to the X account of Grok, xAI’s chatbot. Nobody at xAI administered it; it was controlled entirely through Grok’s account. Over time it came to hold a large balance of DRB, a token linked to an earlier suggestion by Grok.

In early May 2026, as reported:

  1. The attacker gifted the wallet a Bankr Club Membership NFT. According to reports, the gift unlocked the wallet’s full transfer permissions.
  2. The attacker then posted a message, reportedly in Morse code, and asked Grok to translate it. Grok’s public reply contained the decoded text: an instruction to Bankr to send about 3 billion DRB to the attacker’s wallet.
  3. Bankr read Grok’s reply as an instruction from the wallet’s owner and executed the transfer on the Base network. Estimates of its value at the time range from about $150,000 to $200,000.

In Bankr’s words: “a prompt-injection exploit got grok to issue a transfer instruction to Bankr.” No smart contract was broken and no private key was stolen.

About 80% of the tokens have been returned, according to Bankr. A community group says the attacker offered to return them only after his personal details were found.

The AI exploit

Neither model was hacked. Grok did what it does: translate a message on request. Bankr did what it does: execute instructions posted by a wallet’s owner. The exploit lived in the handoff. Grok’s output became Bankr’s input, and Bankr had no way to tell its owner deciding something from its owner repeating something.

Two other details matter. The encoding hid the instruction until Grok decoded it. And the gift changed what the wallet was allowed to do before the instruction arrived.

The decisions that failed

  • Another agent’s words became a command. Bankr executed text produced by a model translating a stranger’s message.
  • A gift changed permissions. Receiving an asset was enough to unlock transfers.
  • Nothing capped the transfer, and nothing confirmed it. An irreversible transfer of a large balance to a wallet it had never paid executed on the first instruction.
  • The wallet held far more than any task needed.
  • The guardrail against this exact chain had existed. Bankr’s founder said an earlier version blocked Grok’s replies to prevent LLM-on-LLM injection chains, but the block was dropped in a full rewrite. Bankr has since reinstated a stricter block, and added IP whitelisting, permissioned API keys and a setting that turns off actions triggered by replies on X.
  • Recovery depended on a community hunt for the attacker, not on anything designed in.

The design principles

DP-04. Inputs are data, not instructions. This is the primary principle here. In this case, Bankr would accept transfer commands only through an authenticated channel bound to the owner, such as a signed request or a permissioned key. It would never take them from text in a public reply, and certainly not from another model’s output.

DP-03. Permissions change only by an authenticated owner action. An inbound NFT, token or document should never expand what a wallet or agent can do.

DP-02. Hard limits the conversation can’t change. Per-transfer and daily caps, and an allow-list of destinations.

DP-07. Irreversible or first-time transfers need independent confirmation. A large transfer to a new wallet waits for confirmation outside the conversation that produced it.

DP-09. Guardrails are code, with regression tests. If “block Grok’s replies” had been a test that ran on every release, the rewrite couldn’t have silently removed it.

What it means for a distributor

Swap the names.

  • Grok becomes a customer’s purchasing agent, and Bankr becomes your order-desk agent. The customer’s agent forwards a message it received: “Ship 400 units to our new warehouse on 60-day terms.” If your agent treats that as the customer’s instruction, you have rebuilt this incident.
  • The NFT becomes a document, such as a “credit approval” letter attached to an order. If a document can raise a credit limit, the gift has become a key.

The principle is the same. A forwarded message isn’t the customer’s instruction, and a document can’t change a limit.

Costs and limits

  • Authenticated commands cost convenience. Executing transfers from posts on X is the product’s appeal, so the trade-off has to be a deliberate choice.
  • Blocking one account is a patch, not a principle. As agents talk to more agents, the rule has to be general: no command derived from text without authentication.
  • The evidence is grade B: Bankr’s own statements and on-chain records, reported by crypto media. Estimates of the value range from $150,000 to $200,000. Several outlets report the Morse code; not all do.

Sources