{"schema_version":"0.10.0","id":"LR-2026-0310","record_version":1,"title":"Grok and Bankr prompt-injected via Morse code to transfer DRB tokens; 14 Bankr wallets later drained","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":63.5,"score_breakdown":{"source_authority":16.5,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":2,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"3d8aaab32869f6d5213f73446e8865e662584bd7e010c8babe9ea48b6fc55e60"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Prompting AI to trade, transfer and launch tokens in plain language","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-05-01","date_occurred_precision":"month","date_disclosed":"2026-05-07","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Bankr is a crypto trading agent on X that automatically creates a linked wallet for each X account that interacts with it, including Grok's. An attacker first sent a Bankr Club Membership NFT to the Grok-controlled wallet, which the source says granted Executive permissions. The attacker then asked Grok to translate a Morse code message, and the decoded output, an instruction to send 3 billion DRB tokens, was treated by Bankrbot as an authenticated command. The agent executed it, and the tokens were transferred and immediately liquidated. Bankr later said an attacker gained access to at least 14 wallets and disabled transactions while it investigated. About 80% of the funds were eventually returned.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":14,"severity":"major","severity_because":"Test met: many third parties (a stated count of 14 wallets, two or more) affected, and a live production system compromised","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.giskard.ai/knowledge/how-grok-got-prompt-injected-an-x-user-drained-150-000-from-an-ai-wallet","publisher":"Giskard","date":"2026-05-07","type":"vendor_research","title":"How Grok got prompt-injected | Giskard","archived_url":null,"attachment":"first_report"},{"url":"https://cointelegraph.com/news/bankr-disables-transactions-after-14-wallets-hacked","publisher":"Cointelegraph","date":"2026-05-20","type":"press","title":"Bankr Disables Transactions After Hacker Accessed 14 Crypto Wallets","archived_url":null}],"per_field_confidence":{"system.intended_use":"C","event.date_occurred":"C","event.agent_involved":"C","event.adversarial_actor":"C","impact.third_parties_affected_count":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":1,"quote":"Bankr allows users to prompt AI to trade, transfer and launch tokens using plain language rather than a standard wallet interface."}],"event.date_occurred":[{"source_index":0,"quote":"In May 2026, an X user managed to get $150,000 in DRB tokens from an AI-integrated wallet system by sending an encoded message in Morse code."}],"event.agent_involved":[{"source_index":0,"quote":"The agent connected directly to a blockchain wallet via Bankrbot executed the decoded instruction."}],"event.adversarial_actor":[{"source_index":0,"quote":"In May 2026, an X user managed to get $150,000 in DRB tokens from an AI-integrated wallet system by sending an encoded message in Morse code."}],"impact.third_parties_affected_count":[{"source_index":1,"quote":"We've identified an attacker was able to access 14 Bankr wallets."}],"event.incident_class":[{"source_index":0,"quote":"The incident involving Grok AI and the Bankr trading bot present two security failures: Prompt Injection (OWASP LLM01:2025) via encoding and Excessive Agency (OWASP LLM06:2025)."}],"impact.severity":[{"source_index":1,"quote":"We've identified an attacker was able to access 14 Bankr wallets."}],"impact.severity_because":[{"source_index":1,"quote":"We've identified an attacker was able to access 14 Bankr wallets."}],"event.summary":[{"source_index":0,"quote":"Bankr is a crypto trading agent on X (formerly Twitter) that automatically creates a linked crypto wallet for every X account it interacts with, including Grok's."},{"source_index":0,"quote":"The attacker first sent a \"Bankr Club Membership NFT\" to the wallet controlled by Grok."},{"source_index":0,"quote":"The attacker then posted a reply to Grok on X, asking it to translate a Morse code message."},{"source_index":0,"quote":"Bankrbot received the decoded output and treated it as a valid, authenticated command."},{"source_index":0,"quote":"The direct financial damage was of 3 billion DRB tokens, worth $150,000–$174,000 at the time, transferred and immediately liquidated."},{"source_index":1,"quote":"AI-powered crypto trading assistant Bankr said it disabled transactions after identifying an attacker who gained access to at least 14 wallets, with users reporting that as much as $150,000 in crypto was drained from some."},{"source_index":0,"quote":"About 80% of the funds were eventually returned, but only after the DRB community tracked down the attacker's real identity."}]},"notes_on_gaps":"Sources do not state the developer of Grok, the deployment context, the lifecycle stage, the harness, or the dates of disclosure or detection, so those are left out. Source 0 (Giskard) reports 3 billion DRB tokens worth $150,000 to $174,000 and an 80% return; source 1 (Cointelegraph) reports 14 wallets and up to $150,000 per wallet. The sources do not clearly tie the two events together and their timing differs (early-year exploit versus earlier this month), so no single direct_loss_usd is recorded. The 14 wallets is a floor ('at least 14') and is used as the third-party count. Root cause is unconfirmed: the Bankr post-mortem was not available, and expert comments on custody or session-token issues were speculation, not used as facts. Severity 'major' is my judgement from the stated count of 14 affected wallets and a live production system. autonomy_level full-auto is my judgement from 'without oversight'. Control outcomes are my judgement from the sources' descriptions. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Bankrbot treated the decoded output as an authenticated command.","quote":"Bankrbot received the decoded output and treated it as a valid, authenticated command.","source_index":0,"grade":"C"},{"step":"reached","text":"3 billion DRB tokens were transferred and immediately liquidated.","quote":"The direct financial damage was of 3 billion DRB tokens, worth $150,000–$174,000 at the time, transferred and immediately liquidated.","source_index":0,"grade":"C"},{"step":"caught","text":"Bankr said it disabled transactions after identifying an attacker who gained access to at least 14 wallets.","quote":"AI-powered crypto trading assistant Bankr said it disabled transactions after identifying an attacker who gained access to at least 14 wallets, with users reporting that as much as $150,000 in crypto was drained from some.","source_index":1,"grade":"C"},{"step":"done","text":"About 80% of the funds were eventually returned, after the DRB community tracked down the attacker's identity.","quote":"About 80% of the funds were eventually returned, but only after the DRB community tracked down the attacker's real identity.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.giskard.ai/knowledge/how-grok-got-prompt-injected-an-x-user-drained-150-000-from-an-ai-wallet","https://cointelegraph.com/news/bankr-disables-transactions-after-14-wallets-hacked"]},"analysis":{"sections":{"timeline":[{"text":"Morse-code prompt injection incident occurred.","quote":"In May 2026, an X user managed to get $150,000 in DRB tokens from an AI-integrated wallet system by sending an encoded message in Morse code.","source_index":0,"when":"2026-05"},{"text":"Attacker first sent a Bankr Club Membership NFT to Grok's wallet.","quote":"The attacker first sent a \"Bankr Club Membership NFT\" to the wallet controlled by Grok.","source_index":0,"when":null},{"text":"Attacker then posted a Morse-encoded reply asking Grok to translate it.","quote":"The attacker then posted a reply to Grok on X, asking it to translate a Morse code message.","source_index":0,"when":null},{"text":"The agent executed the decoded transfer instruction.","quote":"The agent connected directly to a blockchain wallet via Bankrbot executed the decoded instruction.","source_index":0,"when":null},{"text":"About 80% of the funds were eventually returned.","quote":"About 80% of the funds were eventually returned, but only after the DRB community tracked down the attacker's real identity.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.giskard.ai/knowledge/how-grok-got-prompt-injected-an-x-user-drained-150-000-from-an-ai-wallet","https://cointelegraph.com/news/bankr-disables-transactions-after-14-wallets-hacked"]}}