AI Risk Wire

Cases › other › LR-2026-0318

BasisOS yield protocol on Virtuals Protocol: human operator posed as AI agent and $500,000 of user funds were stolen

Preliminary Why: Only a republished copy: Yahoo Finance · subject to change

Status: no action reported

Severity moderate
Loss or records US$500,000
Reported 28 Nov 2025

No source states: developer and model, agent tool, could do, deployer, industry.

Severity moderate: Test: data or systems of others touched with a bounded scope stated. User funds of investors were stolen and the scope is stated as $500,000.

BasisOS was presented as an AI agent running a yield optimization protocol on the Virtuals Protocol platform, and investors deposited funds to chase higher yields. According to the source, an insider engineer handled the wrapper code for transactions and agent deployment and manually controlled the vault, mimicking automated behaviour from early November when it launched. The press report states that $500,000 of user funds were stolen. It was then revealed that BasisOS was not an AI agent but was run by a human operator. The Virtuals co-founder said the platform would reimburse affected users, which the report links to earlier promotion of BasisOS's native token BIOS.

What happened

1 · What it was doingAn insider engineer handled the wrapper code and manually controlled the vault while mimicking automated behaviour.
2 · What went wrongThe system presented as an AI agent stole $500,000 of user funds.
3 · What it reached or didInvestors chasing higher yields deposited their funds with BasisOS.
4 · How it was caughtIt was revealed that BasisOS was not an AI agent but was run by a human operator.

What was done

No source states an action or fix.

Risks

Deception, concealment or sabotage
Primary16 incidents
Agent takes destructive or unapproved actions
Also63 incidents
Rising: 5 vs 2.2 a week

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Reasoning monitoring · Realistic behaviour evaluations

Harness

Tamper-proof records

Application

Live behaviour monitoring · Human approval for high-impact actions · Activity logs

Evidence

No source states: when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 4 items from the primary sources

What happened, in order

Not dated in the sources:

  • The insider mimicked automated behaviour from early November, when the protocol launched.
  • The system stole $500,000 of user funds.
  • It was revealed that BasisOS was run by a human operator, not an AI agent.
  • The Virtuals co-founder said the platform would reimburse affected users.
Show every field, with its source and grade

The AI system

What it was for
yield optimization protocol
C one secondary source states it

What happened

Earliest source we hold
2025-11-28
D inferred by us from the described behaviour, reason shown
Who caused it
an insider
C one secondary source states it
What went wrong
other
D inferred by us from the described behaviour, reason shown
AI agent
no AI agent acted
C one secondary source states it
primary risk
RK09
D inferred by us from the described behaviour, reason shown
secondary risks
RK02
D inferred by us from the described behaviour, reason shown

Impact

Direct loss
$500,000
C one secondary source states it
Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
money
C one secondary source states it
Who was affected
Investors who deposited funds chasing higher yields
C one secondary source states it
Why this severity
Test: data or systems of others touched with a bounded scope stated. User funds of investors were stolen and the scope is stated as $500,000.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The exact date of the theft is not stated; the 2025-11-25 date is the end of the period the article describes the ecosystem as operating on code is law, not a date of theft. Reversibility is unknown because the reimbursement is only announced.

LR-2026-0318 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON