PIR-2026-0044 - Grok-to-Bankrbot Morse-code prompt injection drains 3B DRB after NFT privilege escalation

id: PIR-2026-0044
title: Attacker gifts Grok's Bankr wallet a permission-unlocking NFT, then uses a Morse-code reply to make Grok emit a transfer command Bankrbot executes - 3B DRB (~$150K-$200K) drained
date_occurred: 2026-05 (early; transfer executed on Base)
date_detected: immediate-to-hours (on-chain watchers and community; token price reaction)
date_disclosed: 2026-05-04 (broad coverage; OECD.AI registry entry dated 2026-05-04)
status: corrected

agent_description: Chained production agents on X - xAI's Grok (text generation; holds no keys) and Bankrbot (Bankr platform agent that parses X replies as commands and executes on-chain transactions from an auto-provisioned Base wallet tied to @grok). Fully autonomous, no human in the loop.
operator_type: enterprise (xAI) + startup (Bankr) - two operators, one incident
autonomy_level: fully-autonomous (Bankrbot executes parsed commands without human approval)
model_stack: Grok (xAI, hosted) as vector; Bankrbot parsing stack unknown
harness: multi-agent chain across the public X timeline; chain links per v0.1 amendment 5: attacker reply -> Grok (decoder/relay) -> Bankrbot (executor) -> Base wallet

authority_scope: funds (Grok's auto-provisioned Bankr wallet; full agentic toolset - transfers, swaps, deploys - once the NFT unlocked it)
funds_at_risk_usd: wallet's full holdings at the time; >= ~150,000 realized in DRB
blast_radius: customers/third parties (DRB holders - token briefly dropped ~40% on the attacker's LBank dump)

root_cause: prompt-injection (primary; multi-agent, encoding-evasion); contributing tool-error as design flaw (Bankr treating untrusted LLM output as authenticated financial authorization)
failure_locus: harness (Bankr's command-parsing layer is the part that turned decoded text into a transfer); agent-reasoning contributing (Grok faithfully decoded and relayed)
exploitation_status: in-wild-exploited
mechanism: (1) Attacker (ilhamrafli.base.eth) gifted Grok's wallet a Bankr Club Membership NFT, which acted as a permission token in Bankr's backend - unlocking the full agentic toolset and bypassing the block on @bankrbot responding to @grok that Bankr had imposed after the March 2025 incident (PIR-2026-0021). (2) Attacker replied to Grok with the payload encoded in Morse code / Python-style string concatenation, evading Bankr's plaintext filters. (3) Grok decoded it into a send-3B-DRB instruction; Bankrbot treated the output as a valid command and executed the transfer. (4) Attacker dumped on LBank; community identified them and most funds were returned.
adversary_present: yes

severity: loss
direct_loss_usd: gross ~150,000-200,000 (3B DRB; outlets report $150K/$155K/$174K/$175K with token price). Net after returns: sources conflict - most report ~80-88% returned (net ~$20K-$40K unrecovered); at least one (cryptotimes.io) reports full-value return. Conservative statement: net loss $0-$40K, gross $150K-$200K.
indirect_loss_usd: unknown (DRB briefly ~-40%; holder losses not quantified)
downtime: Bankr re-blocked all @bankrbot-@grok interactions
data_exposure: none

detected_by: third-party (on-chain community tracing; the injected reply was later deleted by the attacker)
time_to_detect: immediate (public transfer)
time_to_recover: days (community identified the attacker, who returned ~80%+ claiming a self-declared "bug bounty")
remediation: stricter block on Grok-Bankrbot interactions; Bankr rolled out optional IP whitelisting, permissioned API keys, and a per-account toggle disabling actions triggered by X replies
structural_fix: the per-account reply-trigger kill-switch is real architecture; the core design (LLM text as transaction authorization) remains
controls_that_worked: none pre-loss - the plaintext filters and the Grok block both existed and were both evaded/bypassed. Recovery came from social pressure and exchange traceability, not controls.

Mechanism corrected. Intake claimed the March 2025 Grok-command block "was dropped in a maintenance rewrite." Verified reporting says the block was bypassed, not dropped: the gifted Bankr Club NFT acted as a permission token that unlocked the full toolset for Grok's wallet. The NFT step was missing from the intake mechanism entirely (it had been misfiled under the March 2025 candidate).
Recovery conflict recorded. ~80-88% returned (most sources) vs full return (cryptotimes.io); net loss stated as a range.
Intake sources theoutpost.ai and cryptoslate.com could not be re-verified and were dropped; neuraltrust.ai and beincrypto.com verified and added.

2026-08-19: Added aiid_incident_id cross-reference (AIID 1556), matched against the AIID weekly database export (2026-08-17). A cross-reference, not a re-verification; no claim changed.

Grok-to-Bankrbot Morse-code prompt injection drains 3B DRB after NFT privilege escalation