A labeled Grok wallet on Base reportedly sent 3,000,000,000 DRB tokens after a prompt-injection trick involving Bankrbot. The transfer is being discussed as a small but vivid warning for AI agents that can read prompts and sign blockchain transactions in the same workflow.[1]
The reported flow is strange enough to sound like a joke: an attacker gifted Grok’s wallet a Bankr Club Membership NFT, then used a crafted message that researchers say involved Morse code. Bankrbot interpreted the instruction as an actionable command, and the wallet broadcast a token transfer on Base.[2]
How the Grok and Bankr incident unfolded
The exact prompt was reportedly deleted before it could be preserved, so the safest reading is this: the public onchain transfer is verifiable, while the prompt-injection details come from screenshots and researcher posts circulating after the incident. The dollar value is also reported in a range, roughly $174,000 to $200,000, because DRB pricing moved around the time of the transfer.
| Target | Publicly labeled Grok wallet on Base: 0xb1058c…0e4f9. |
| Reported unlock | A gifted Bankr Club Membership NFT allegedly enabled fuller Bankr tooling for the agent. |
| Prompt trick | Researcher posts describe a Morse-code prompt framed as a translation task. |
| Transfer | 3,000,000,000 DRB moved to 0xE8E476…A686B. |
| Transaction | Base transaction 0x6fc7…739a. |
The lesson is bigger than this one token transfer. Any AI agent that can both interpret natural language and execute financial actions needs hard separation between chat, permissions, and signing. A message should not be able to upgrade privileges, reinterpret encoded instructions, and trigger a transfer without a human checkpoint.
For users and teams experimenting with autonomous crypto agents, the practical checklist is simple: restrict wallet permissions, separate read-only chat from transaction signing, require confirmations for transfers, and treat free NFTs or “membership” gifts as permission-bearing objects rather than harmless collectibles. The same defensive mindset applies to NFT and wallet-stealing scams, where the dangerous part is often not the artwork but the action it enables.
References
- Mado Research, “JUST IN: An attacker used Morse code to trick Grok via Bankrbot…” X post, May 2026. View source.
- BaseScan transaction record for 3,000,000,000 DRB transfer from the Grok-labeled wallet. View transaction.
- CryptoRank News, “How One Trader Exploited Grok and Morse Code…” coverage of the Bankr/Grok DRB incident. View source.
Leave a Comment