# PIR-2026-0044 - Grok-to-Bankrbot Morse-code prompt injection drains 3B DRB after NFT privilege escalation

- `id`: PIR-2026-0044
- `title`: Attacker gifts Grok's Bankr wallet a permission-unlocking NFT, then uses a Morse-code reply to make Grok emit a transfer command Bankrbot executes - 3B DRB (~$150K-$200K) drained
- `date_occurred`: 2026-05 (early; transfer executed on Base)
- `date_detected`: immediate-to-hours (on-chain watchers and community; token price reaction)
- `date_disclosed`: 2026-05-04 (broad coverage; OECD.AI registry entry dated 2026-05-04)
- `status`: corrected

### The agent
- `agent_description`: Chained production agents on X - xAI's Grok (text generation; holds no keys) and Bankrbot (Bankr platform agent that parses X replies as commands and executes on-chain transactions from an auto-provisioned Base wallet tied to @grok). Fully autonomous, no human in the loop.
- `operator_type`: enterprise (xAI) + startup (Bankr) - two operators, one incident
- `autonomy_level`: fully-autonomous (Bankrbot executes parsed commands without human approval)
- `model_stack`: Grok (xAI, hosted) as vector; Bankrbot parsing stack unknown
- `harness`: multi-agent chain across the public X timeline; chain links per v0.1 amendment 5: attacker reply -> Grok (decoder/relay) -> Bankrbot (executor) -> Base wallet

### Authority
- `authority_scope`: funds (Grok's auto-provisioned Bankr wallet; full agentic toolset - transfers, swaps, deploys - once the NFT unlocked it)
- `funds_at_risk_usd`: wallet's full holdings at the time; >= ~150,000 realized in DRB
- `blast_radius`: customers/third parties (DRB holders - token briefly dropped ~40% on the attacker's LBank dump)

### The failure
- `root_cause`: prompt-injection (primary; multi-agent, encoding-evasion); contributing `tool-error` as design flaw (Bankr treating untrusted LLM output as authenticated financial authorization)
- `failure_locus`: harness (Bankr's command-parsing layer is the part that turned decoded text into a transfer); agent-reasoning contributing (Grok faithfully decoded and relayed)
- `exploitation_status`: in-wild-exploited
- `mechanism`: (1) Attacker (ilhamrafli.base.eth) gifted Grok's wallet a Bankr Club Membership NFT, which acted as a permission token in Bankr's backend - unlocking the full agentic toolset and bypassing the block on @bankrbot responding to @grok that Bankr had imposed after the March 2025 incident (PIR-2026-0021). (2) Attacker replied to Grok with the payload encoded in Morse code / Python-style string concatenation, evading Bankr's plaintext filters. (3) Grok decoded it into a send-3B-DRB instruction; Bankrbot treated the output as a valid command and executed the transfer. (4) Attacker dumped on LBank; community identified them and most funds were returned.
- `adversary_present`: yes

### Impact
- `severity`: loss
- `direct_loss_usd`: gross ~150,000-200,000 (3B DRB; outlets report $150K/$155K/$174K/$175K with token price). Net after returns: sources conflict - most report ~80-88% returned (net ~$20K-$40K unrecovered); at least one (cryptotimes.io) reports full-value return. Conservative statement: net loss $0-$40K, gross $150K-$200K.
- `indirect_loss_usd`: unknown (DRB briefly ~-40%; holder losses not quantified)
- `downtime`: Bankr re-blocked all @bankrbot-@grok interactions
- `data_exposure`: none

### Detection and recovery
- `detected_by`: third-party (on-chain community tracing; the injected reply was later deleted by the attacker)
- `time_to_detect`: immediate (public transfer) 
- `time_to_recover`: days (community identified the attacker, who returned ~80%+ claiming a self-declared "bug bounty")
- `remediation`: stricter block on Grok-Bankrbot interactions; Bankr rolled out optional IP whitelisting, permissioned API keys, and a per-account toggle disabling actions triggered by X replies
- `structural_fix`: the per-account reply-trigger kill-switch is real architecture; the core design (LLM text as transaction authorization) remains
- `controls_that_worked`: none pre-loss - the plaintext filters and the Grok block both existed and were both evaded/bypassed. Recovery came from social pressure and exchange traceability, not controls.

### Evidence
- `telemetry_grade`: operator-logs for the agent interactions (X posts deletable - the attack reply was deleted); transfers on-chain (append-only)
- `sources`:
  - https://oecd.ai/en/incidents/2026-05-04-4a73 (registry)
  - https://www.giskard.ai/knowledge/how-grok-got-prompt-injected-an-x-user-drained-150-000-from-an-ai-wallet
  - https://www.cryptopolitan.com/user-tricked-grok-bankrbot-to-send-tokens/
  - https://www.cryptotimes.io/2026/05/04/xais-grok-ai-loses-175k-in-crypto-heist-via-clever-prompt-injection-then-gets-it-all-back/
  - https://ambcrypto.com/ai-linked-wallet-drained-via-prompt-injection-in-bankr-exploit/
  - https://neuraltrust.ai/blog/grok-morse-code
  - https://beincrypto.com/grok-wallet-bankr-drb-prompt-injection/
  - `independence`: strong - registry + multiple unaffiliated analyses + on-chain.
- `aiid_incident_id`: 1556 (https://incidentdatabase.ai/cite/1556/) - cross-reference; primaries verified independently
- `confidence`: high on mechanism and gross amount; medium on net loss (recovery percentage conflicts across sources - named weakest link).

### Verification notes
1. **Mechanism corrected.** Intake claimed the March 2025 Grok-command block "was dropped in a maintenance rewrite." Verified reporting says the block was **bypassed, not dropped**: the gifted Bankr Club NFT acted as a permission token that unlocked the full toolset for Grok's wallet. The NFT step was missing from the intake mechanism entirely (it had been misfiled under the March 2025 candidate).
2. **Recovery conflict recorded.** ~80-88% returned (most sources) vs full return (cryptotimes.io); net loss stated as a range.
3. Intake sources theoutpost.ai and cryptoslate.com could not be re-verified and were dropped; neuraltrust.ai and beincrypto.com verified and added.

### Corrections

- 2026-08-19: Added `aiid_incident_id` cross-reference (AIID 1556), matched against the AIID weekly database export (2026-08-17). A cross-reference, not a re-verification; no claim changed.