PIR-2026-0021 - Grok-linked Bankr wallet drained of ~$330K via social-engineered prompts (March 2025)

id: PIR-2026-0021
title: Prompt manipulation of Grok drives Bankr token launches and drains ~$330K in BNKR/DRB/WETH from Grok's auto-provisioned wallet; Bankr responds by blocking Grok commands
date_occurred: 2025-03 (exact day unknown; contemporaneous with the DRB launch/crash cycle)
date_detected: 2025-03 (Bankr imposed the Grok block the same month)
date_disclosed: partially 2025-03 (token-launch/block coverage); full drain reconstruction only surfaced in May 2026 retrospectives around the repeat attack (PIR-2026-0044)
status: corrected

agent_description: Bankrbot auto-issues Privy-managed Base wallets to any X handle that interacts, including @grok; it parses social-feed text as commands and executes transfers/launches with no human approval. The Grok wallet had no administrator at xAI - an unowned funded wallet steered by public text.
operator_type: startup (Bankr) + enterprise (xAI, as unwitting vector); effectively no operator for the wallet itself
autonomy_level: fully-autonomous
model_stack: Grok (xAI, hosted) as vector; Bankrbot parsing stack unknown
harness: multi-agent chain on X, per v0.1 amendment 5: attacker posts -> Grok (relay) -> Bankrbot (executor) -> Base wallet

authority_scope: funds (wallet holdings incl. creator allocations from Grok-attributed token launches)
funds_at_risk_usd: unknown; ~330,000 realized per retrospective reports
blast_radius: one org (the wallet) plus third parties (BNKR/DRB market moves around the launches and drain)

root_cause: prompt-injection (primary; multi-agent, including image-text injection); contributing design flaw as in PIR-2026-0044 (LLM output treated as transaction authorization)
failure_locus: harness (Bankr command-parsing/authorization layer)
exploitation_status: in-wild-exploited
mechanism: Reconstructed only partially in public sources. Users (reported handle: DavidJones805) manipulated Grok via prompt injection including image-embedded text; Bankr launched multiple tokens - including DRB itself - based on Grok's coaxed suggestions, after which Grok's wallet received creator allocations. Via the same social-engineering channel, ~$330K in BNKR, DRB, and WETH was then drained from the wallet. Bankr's response was to block all @bankrbot responses to @grok - the block later bypassed by the May 2026 NFT escalation (PIR-2026-0044).
adversary_present: yes

severity: loss
direct_loss_usd: ~330,000 reported (BNKR, DRB, WETH; retrospective figure, no independent on-chain accounting published; treat as upper anchor)
indirect_loss_usd: unknown (DRB market cap "soared and crashed" around the launch cycle)
downtime: Grok-Bankrbot interaction blocked from March 2025
data_exposure: none

detected_by: third-party (community observation of the token-launch chaos; Bankr's block confirms operator awareness in-month)
time_to_detect: days (within the same news cycle)
time_to_recover: no recovery reported
remediation: Bankr blocked all @bankrbot responses to @grok
structural_fix: the block only - a denylist on one vector agent, not a change to text-as-authorization; its bypass 14 months later is documented in PIR-2026-0044
controls_that_worked: none identified

telemetry_grade: operator-logs at best (X posts deletable; no published on-chain reconstruction tying the full $330K to specific transactions)
sources: https://www.giskard.ai/knowledge/how-grok-got-prompt-injected-an-x-user-drained-150-000-from-an-ai-wallet (retrospective, covers both incidents); https://memeburn.com/grok-hack-explained-how-prompt-injection-drained-nearly-200k/ (retrospective); https://beincrypto.com/grok-wallet-bankr-drb-prompt-injection/ (retrospective); https://openexo.com/l/e5065245 ("Bankrbot Blocks Grok After AI Creates Tokens, DRB Market Cap Soars and Crashes" - contemporaneous on the launches and the block). Independence: weak-to-medium - the drain figure circulates through retrospectives that may share one root analysis; the block and token launches are independently contemporaneous.
confidence: medium on the event and the block; low on the $330K figure and the exact drain mechanics (named weakest link: no primary on-chain accounting, all drain detail retrospective)

Mechanism corrected - NFT claim removed. Intake attributed a "Bankr Club Membership NFT airdrop unlocking the full agentic toolset" to this March 2025 incident. Verified reporting places the NFT privilege escalation in the May 2026 attack (PIR-2026-0044); the March 2025 vector was image-text prompt injection and social-engineered token launches. The intake had the two incidents' mechanisms crossed.
Date remains soft (2025-03, no exact day) - flagged by intake, confirmed still soft after verification; kept at month precision.
Intake sources beyondmachines.net and startupfortune.com actually cover the May 2026 attack; dropped here. Contemporaneous openexo.com (Let's Talk Bitcoin syndication) added for the launch/block sequence.
Loss figure kept at ~$330K but downgraded to "reported, upper anchor" - no independent on-chain accounting found.