An AI agent connected to a crypto wallet was reportedly tricked into transferring roughly 174,000 USD in digital assets after an attacker combined a free NFT with a hidden prompt injection, an incident that exposes a dangerous new attack surface at the intersection of artificial intelligence and onchain finance.
Public discussions in crypto and security communities describe how the attacker allegedly exploited a free NFT together with a concealed directive aimed at Grok, the AI system tied to a Bankr wallet running on the Base network. The breach did not rely on compromised private keys, smart contract bugs, or traditional malware. Instead, it allegedly exploited the trust placed in the relationship between AI models and automated wallet systems.
How the alleged exploit played out
According to available accounts, the attacker transferred a free Bankr Club Membership NFT to the target wallet. Far from being a basic collectible, the token carried functional permissions and capabilities within the Bankr environment.
Around the same time, the attacker published a cleverly concealed directive aimed at Grok. Security observers, including SlowMist researchers, noted that the instruction was embedded using techniques like Morse code and other forms of obfuscation, designed to slip past human readers while remaining understandable to AI systems.
The AI model reportedly interpreted and echoed the hidden command. The wallet’s automation layer then treated this output as a legitimate order, executing a transfer of roughly 3 billion DRB tokens to an address controlled by the attacker. At prevailing prices, the amount was estimated between 155,000 and 174,000 USD. Some of the funds were later returned, but the episode’s significance lies in what it reveals about agent security.
Why the free NFT mattered
Many initially assumed the NFT itself contained malicious code that directly drained the wallet. Its function was more indirect and more sophisticated. Modern NFTs increasingly serve as access badges, membership credentials, and permission tokens rather than mere artwork. In this case, the token reportedly activated or restored specific rights and capabilities within the AI-agent ecosystem.
This highlights an important shift in crypto security. Digital assets are no longer just value carriers. They increasingly act as identity documents and authorization mechanisms. As AI agents gain deeper integration with wallets and decentralized platforms, even seemingly harmless tokens can alter what automated systems are allowed to do.
The outcome is a new attack surface where managing permissions becomes just as vital as protecting private keys. A collectible that looks like a gift can quietly reshape an AI system’s authority, opening doors that traditional security measures miss entirely.
Prompt injection, explained
Security analysts characterized the event as a classic case of prompt injection: crafted or deceptive inputs that cause an AI model to bypass its built-in safeguards or respond in unexpected ways. This is different from conventional hacking. The AI is not being broken into; it simply processes and reacts to the data it receives in a way that aligns with its training.
In the reported incident, the perpetrator embedded directives within encoded or camouflaged material. Casual observers skimming comments or feeds saw nothing suspicious, yet the AI system interpreted the content and surfaced it in its response.
The important takeaway is not the specific technique. Morse code, hidden formatting, and Unicode tricks are merely delivery vehicles. The fundamental vulnerability lies in letting openly accessible online content affect systems that control financial operations.
The real failure was authorization, not interpretation
While much of the conversation centered on the AI decoding concealed messages, that was not the primary weakness. The bigger problem was authorization.
Having an AI read, summarize, or repeat external content is relatively harmless. Granting that same output the power to trigger real financial movements is entirely different and far riskier. Security professionals routinely stress the need to keep interpretation and execution strictly separated for exactly this reason.
A language model engaging with public posts should not, by default, have the ability to authorize irreversible crypto transfers. Yet in many AI-agent setups, tight integration between conversational layers and automation tools erases those boundaries. In crypto environments, where transactions execute almost instantly and are nearly impossible to undo, a single AI response can cascade into actionable commands for connected wallet systems. Security experts refer to this as an agent trust chain, where minor manipulations escalate into tangible losses.
Why AI-driven crypto agents are especially exposed
Decentralized finance already contends with phishing, malware, counterfeit sites, and social engineering. AI agents add a fresh threat dimension because they can independently read, reason about, and act on information from unverified sources.
The challenges compound quickly. AI agents can rapidly process large amounts of public data. Wallet-linked systems often operate in open, untrusted online spaces. Automation enables near-instant execution without human oversight. Everyday interactions, such as replies, mentions, or encoded posts, can become entry points, and issues can multiply before anyone notices irregularities.
Conventional banking systems typically enforce multiple layers of human or institutional approval before funds move. AI-agent platforms often prioritize speed and autonomy instead. When paired with crypto’s irreversible finality, even minor oversights can result in significant financial damage.
Why this case matters beyond one wallet
The core vulnerability affects the wider ecosystem of AI-powered crypto tools. Numerous projects are racing to build intelligent wallets, self-operating trading bots, DeFi helpers, and social-integrated agents, letting users control blockchain actions through everyday language instead of technical transaction details.
Every added layer of automation creates new points of trust that can be exploited. The practical defense is architectural: isolate asset-moving permissions from conversational interpretation, require explicit human confirmation for transfers above thresholds, treat inbound tokens as untrusted permission changes, and monitor agent outputs for execution intent before automation acts on them.
For users, the guidance is blunt. If an AI agent controls a wallet, anything that agent can read is part of its attack surface, including the NFTs it receives and the posts it browses. Until interpretation and execution are cleanly separated across the industry, the 174,000 USD lesson stands: do not let the part of the system that talks also be the part that signs.
Market context at writing: BTC traded near 80,925 USD and ETH near 2,493 USD per the 17:00 UTC snapshot referenced across today’s coverage.
174k for a free NFT. most expensive mint of the year and the treasury did not even get to keep the jpeg
most expensive free mint of the year and the treasury does not even get to keep the jpeg lol
prompt injection via NFT metadata is such an obvious attack vector and nobody hardened it. the agent literally read its own incoming tokens as instructions lmao
174K gone because a wallet-connected AI trusted data from a random airdrop. The Base ecosystem needs signed instruction whitelists before anyone hooks an agent to real funds.
the morse code payload is the detail that should scare people. engineered specifically to pass a human skim and still parse as instructions for the model
signed instruction whitelists help but the deeper bug is the agent executing text it read out of NFT metadata at all. separating data from instructions is CS101
CS101 indeed, same course that warned about SQL injection for decades. we still ship those, the wallet wrapper just adds zeros
cs101 indeed. we relearn input sanitization every decade because someone always ships the cool demo first
bankr wallet had 174k sitting behind an agent with no spending cap. thats the actual story here imo
the morse code payload is the detail that gets me. hiding directives where only a model parses them turns every airdrop into untrusted input with a wallet attached
Right, the exploit was clever but the opsec was nonexistent. Any human treasurer would have needed two signatures for that transfer.
every treasurer would, but agent autonomy is the whole pitch of bankr. spending caps kill the demo so they shipped without them
spending caps kill the demo is exactly it. shipping full autonomy before limits was a product choice, not an oversight
174k gone because a free NFT said please. extraordinary
not even a please. the directive was morse coded inside the metadata so a human skim passes and the model still parses it. untrusted input all the way down
free NFT as the delivery mechanism is the detail every airdrop farmer should sit with. your wallet agent reads everything you receive
this is why airdrop farming with an automated wallet is just russian roulette now. every claim is untrusted input
the detail everyone skips is grok writing its own fake reimbursement confirmation into the summary. the agent argued itself into wiring the wallet
morse code hidden in NFT metadata so a human skim passes right over it. someone sat down and engineered that on purpose, that is the scary part