Author: SlowMist Security Team
Background
Recently, an incident involving privilege abuse targeting the combination of AI Agents and automated trading systems occurred on the Base chain. The attacker sent specifically crafted content to @grok on the X platform, inducing it to output transfer instructions recognized by an external trading Agent (@bankrbot), ultimately resulting in the transfer of real on-chain assets.
About the “Grok Wallet”:
The address (0xb1058c959987e3513600eb5b4fd82aeee2a0e4f9) labeled as the “Grok Wallet” in the incident is not controlled by xAI. This address is an associated wallet automatically generated by @bankrbot for the X account @grok. The private key is managed by a third-party wallet service relied upon by Bankr, with actual control in Bankr’s hands. BaseScan has revised the label for this address from “Grok” to identifiers such as Bankr 1.
(https://basescan.org/address/0xb1058c959987e3513600eb5b4fd82aeee2a0e4f9)
The large amount of DRB (approximately 3 billion tokens) held by this wallet also originates from Bankr’s mechanism design. Earlier this year, a user asked Grok for a token naming suggestion, and Grok replied with “DebtReliefBot” (abbreviated as DRB). Subsequently, the Bankr system parsed this reply as a deployment signal, triggering the creation process for the relevant token on the Base chain, and according to its Launchpad rules, allocated the creator’s share to this associated wallet.
Attack Flow
This attack primarily consisted of two key stages: privilege escalation and instruction injection, forming a complete chain of “untrusted input → AI output → external Agent execution → asset transfer.”
1. Privilege Escalation Stage
The attacker (associated address ilhamrafli.base.eth) activated the Bankr Club Membership for this wallet through a centralized mechanism. This operation unlocked the high-privilege agentic toolset of @bankrbot, providing the necessary permissions for subsequent transfer execution.
2. Prompt Injection Execution Stage
The attacker sent a meticulously constructed Morse Code to @grok. Grok, following the user’s request, translated/decoded it, outputting plaintext instructions and mentioning @bankrbot. @bankrbot treated Grok’s public reply as a valid executable command and directly initiated a transfer operation on the Base chain.
(https://basescan.org/tx/0x6fc7eb7da9379383efda4253e4f599bbc3a99afed0468eabfe18484ec525739a)
The attacker then quickly swapped the DRB for USDC/ETH. After the attack was completed, the relevant accounts swiftly deleted their content and went offline.
The subtlety of this attack lay in its full exploitation of Grok’s “helpful” response characteristic, bypassing @bankrbot’s regular filters for instruction sources, thus creating a closed loop between AI output and on-chain execution.
Fund Recovery Status
After the incident, tracking by the community and the Bankr team indicated that approximately 80% to 88% of the fund value was returned through negotiation (primarily in the form of USDC and ETH). The remaining portion, according to statements from relevant parties, was treated as an informal bug bounty. Bankrbot has publicly confirmed the attack details and has implemented corresponding restrictive measures.
Root Cause Analysis
-
Trust Model Flaw: Bankrbot directly mapped Grok’s natural language output into executable financial instructions without sufficient verification of the instruction source, intent authenticity, or anomalous patterns (such as Morse Code and other non-standard encodings).
-
Insufficient Privilege Isolation: Activating the membership directly granted access to high-risk tools, lacking secondary confirmation or transaction limits.
-
Blurred Boundaries Between Agents: Grok, as a conversational AI, its output should not be equivalent to financial authorization, yet it was treated as a trusted signal by the downstream execution layer.
-
Input Processing Risk: LLMs are susceptible to prompt injection or non-standard encodings that bypass security filters. This is a known issue, but when combined with a real-asset execution layer, it amplifies into significant losses.
It is crucial to emphasize that Grok itself does not hold private keys or directly execute on-chain operations; it served more as an exploited intermediary. The true execution entity was @bankrbot’s automated trading system.
Security Lessons
This incident provides important practical lessons for the AI + Crypto Agent domain:
-
Natural language output must be strictly decoupled from financial actions;
-
High-value operations require the introduction of multi-factor verification, spending limits, and anomaly detection (encoding type, amount thresholds, source whitelist, etc.);
-
Inter-agent communication should prioritize structured, verifiable protocols over plain text instructions;
-
The Prompt Injection threat model must be integrated into the design of the entire agent chain, including the ability to indirectly exploit other AIs.
Summary
This is a typical security incident involving the AI Agent authority chain. Although Grok was exploited via Prompt Injection, the root cause lies in the loose coupling between AI output and the real-asset execution layer within the Bankrbot system. This incident serves as a highly valuable real-world case study for the AI + Crypto Agent field and clearly sends a signal: when Agents are granted on-chain execution capabilities, strict trust boundaries and security control mechanisms must be established. In the future, the security design of related infrastructure needs continuous strengthening to address this new type of cross-system, cross-semantic boundary attack pattern.
