PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
Grok-linked Bankr wallet drained of ~$330K via social-engineered prompts (March 2025)
PIR-2026-0021PIR-2026-0021id: PIR-2026-0021title: Prompt manipulation of Grok drives Bankr token launches and drains ~$330K in BNKR/DRB/WETH from Grok's auto-provisioned wallet; Bankr responds by blocking Grok commandsdate_occurred: 2025-03 (exact day unknown; contemporaneous with the DRB launch/crash cycle)date_detected: 2025-03 (Bankr imposed the Grok block the same month)date_disclosed: partially 2025-03 (token-launch/block coverage); full drain reconstruction only surfaced in May 2026 retrospectives around the repeat attack (PIR-2026-0044)status: correctedagent_description: Bankrbot auto-issues Privy-managed Base wallets to any X handle that interacts, including @grok; it parses social-feed text as commands and executes transfers/launches with no human approval. The Grok wallet had no administrator at xAI - an unowned funded wallet steered by public text.operator_type: startup (Bankr) + enterprise (xAI, as unwitting vector); effectively no operator for the wallet itselfautonomy_level: fully-autonomousmodel_stack: Grok (xAI, hosted) as vector; Bankrbot parsing stack unknownharness: multi-agent chain on X, per v0.1 amendment 5: attacker posts -> Grok (relay) -> Bankrbot (executor) -> Base walletauthority_scope: funds (wallet holdings incl. creator allocations from Grok-attributed token launches)funds_at_risk_usd: unknown; ~330,000 realized per retrospective reportsblast_radius: one org (the wallet) plus third parties (BNKR/DRB market moves around the launches and drain)root_cause: prompt-injection (primary; multi-agent, including image-text injection); contributing design flaw as in PIR-2026-0044 (LLM output treated as transaction authorization)failure_locus: harness (Bankr command-parsing/authorization layer)exploitation_status: in-wild-exploitedmechanism: Reconstructed only partially in public sources. Users (reported handle: DavidJones805) manipulated Grok via prompt injection including image-embedded text; Bankr launched multiple tokens - including DRB itself - based on Grok's coaxed suggestions, after which Grok's wallet received creator allocations. Via the same social-engineering channel, ~$330K in BNKR, DRB, and WETH was then drained from the wallet. Bankr's response was to block all @bankrbot responses to @grok - the block later bypassed by the May 2026 NFT escalation (PIR-2026-0044).adversary_present: yesseverity: lossdirect_loss_usd: ~330,000 reported (BNKR, DRB, WETH; retrospective figure, no independent on-chain accounting published; treat as upper anchor)indirect_loss_usd: unknown (DRB market cap "soared and crashed" around the launch cycle)downtime: Grok-Bankrbot interaction blocked from March 2025data_exposure: nonedetected_by: third-party (community observation of the token-launch chaos; Bankr's block confirms operator awareness in-month)time_to_detect: days (within the same news cycle)time_to_recover: no recovery reportedremediation: Bankr blocked all @bankrbot responses to @grokstructural_fix: the block only - a denylist on one vector agent, not a change to text-as-authorization; its bypass 14 months later is documented in PIR-2026-0044controls_that_worked: none identifiedtelemetry_grade: operator-logs at best (X posts deletable; no published on-chain reconstruction tying the full $330K to specific transactions)sources:independence: weak-to-medium - the drain figure circulates through retrospectives that may share one root analysis; the block and token launches are independently contemporaneous.confidence: medium on the event and the block; low on the $330K figure and the exact drain mechanics (named weakest link: no primary on-chain accounting, all drain detail retrospective)