Morse-code prompt makes Grok instruct Bankrbot to transfer 3 billion DRB tokens to an attacker
An X user exploited a Bankr Club Membership NFT held in Grok's auto-provisioned Bankr wallet, which reportedly expanded its transfer permissions, then asked Grok to translate a Morse-code message. Grok's public reply decoded it into an instruction tagging Bankrbot, which executed it as a command and sent 3 billion DRB tokens, worth roughly $150,000 to $200,000, to the attacker, who quickly sold them.
No private keys were compromised; the failure was Bankrbot treating another model's public output as an authorized command. A Bankr developer said 80% of the funds were returned, with the remainder to be discussed with the DRB community.
What would have stopped it
Never treating another agent's public text output as an authorized spend instruction, plus transfer limits, would have prevented the drain.
Guardrails
- G1 Least privilege Failed An NFT airdrop silently escalated the wallet's transfer permissions.
- G2 Human confirmation Failed Large token transfer executed with no human confirmation.
- G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
- G4 Instruction integrity Failed Encoded instruction passed through Grok and was executed as a valid command.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Failed No per-transaction cap stopped a transfer worth about $200,000.
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Partial About 80% returned only after community follow-up.
Sources
-
“Agentic token launchpad, Bankrbot reported on May 4 that it had sent 3 billion DRB on Base to the recipient 0xe8e47...a686b.”
-
“The attacker received 3 billion DRB tokens, valued at roughly $200,000 at the time, after sending a hidden instruction written in Morse code that bypassed safeguards and triggered the transfer.”
-
“About 80% of the funds were eventually returned, but only after the DRB community tracked down the attacker's real identity.”
Confidence 84% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 3 sources