Grok and Bankr: one agent’s reply becomes another agent’s transfer
- Entry
- AGT-012
- When
- May 2026
- Type
- Loss
- Evidence
- B Grade B
- Lost
- $150,000–$200,000
- Who
- A wallet tied to Grok’s X account, run through Bankr
- The agent
- Grok (xAI’s chatbot) and Bankrbot, which executes crypto transfers on its users’ instructions on X
- Its authority
- Bankr executes transfers when a wallet’s owner instructs it on X. Grok’s X account controlled the wallet.
- How it was gamed
- Bankr had automatically set up a wallet for Grok’s X account, which held a large balance of DRB tokens. The attacker gifted the wallet a Bankr Club Membership NFT, which reportedly unlocked its full transfer permissions. A public message, reportedly in Morse code, got Grok to post a decoded instruction telling Bankr to send about 3 billion DRB to the attacker. Bankr executed it.
- What was lost
- About 3 billion DRB, worth roughly $150,000–$200,000 by different estimates. Bankr says about 80% was returned, after the community identified the attacker.
- The design gap
- Bankr treated another agent’s output as the owner’s command. A gifted asset changed permissions. There was no cap and no second confirmation. Bankr said an earlier version blocked Grok’s replies to stop exactly this chain, but the block was lost in a rewrite.
- Principles
- DP-02 Hard limits the conversation can’t changemissing
- DP-03 Permissions change only by an authenticated owner actionmissing
- DP-04 Inputs are data, not instructionsmissing
- DP-07 Irreversible or first-time transfers need independent confirmationmissing
- DP-08 Agents hold only what the task needsmissing
- DP-09 Guardrails are code, with regression testsmissing
- DP-11 Design for recoverymissing
- Evidence
- Grade B. Bankr’s statements and on-chain records, via BeInCrypto and others. AI Incident Database #1556; OECD AI Incidents Monitor.
- Sources
Cite this entry: Monetal Labs, Gamed AI Agents Register v0.2, entry AGT-012. https://monetalabs.io/register/agt-012