Bankr / BankrBot (AI Agent Prompt Injection Exploit)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4Qoe1n…3SPJSummary
In May 2026, Bankr — an AI-powered crypto trading platform operating on the Base network — suffered two successive security breaches rooted in the same architectural flaw: its BankrBot agent treated unverified natural-language outputs from the Grok AI model as authenticated on-chain commands. The first incident on May 4, 2026 resulted in the transfer of approximately 3 billion DRB tokens (valued between $150,000 and $200,000 at the time) via a two-stage attack combining NFT-based privilege escalation with a Morse-code-encoded prompt injection on X. A second breach on May 19, 2026 extended the same permission-chain vulnerability to 14 additional user wallets. Security firm SlowMist classified the root cause as AI agent permission chain abuse and the OECD AI Incidents Monitor catalogued the event as a realised AI incident.
Connected Entities
2 entities · 60 linked investigations- Bankr / BankrBot (AI Agent Prompt Injection Exploit)→mentioned with→Base(70%)
Connected Through
1 shared actor · 80 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Baseorganization
Timeline(9 events)
4 May 2026
Attacker sends Bankr Club Membership NFT to Grok's Base wallet, escalating its permissions to Executive level within the Bankr system.
SlowMist post-mortem4 May 2026
Attacker posts a Morse-code-encoded transfer instruction on X directed at @grok. Grok decodes the message and tags @bankrbot. BankrBot executes an on-chain transfer of approximately 3 billion DRB tokens (value approximately $150,000–$200,000) from wallet 0xb1058c959987e3513600eb5b4fd82aeee2a0e4f9 on Base to the attacker's address. Attacker swaps tokens to USDC and ETH and deletes associated X account.
CryptoTimes; SlowMist post-mortem4 May 2026
BankrBot publicly acknowledges the exploit and disables Grok's ability to issue commands via X replies. Bankr confirms the attack and begins negotiations for fund recovery.
CryptoTimes7 May 2026
SlowMist publishes forensic post-mortem classifying the incident as an AI agent permission chain abuse attack and identifying four root causes.
SlowMist on Medium7 May 2026
CryptoTimes and other outlets report SlowMist's classification and coverage of Bankr's initial remediation measures (IP whitelisting, permissioned API keys, X-reply toggle).
CryptoTimes19 May 2026
Users begin reporting unauthorised activity across 14 Bankr-linked wallets. Attacker exploits the same permission-chain vulnerability. Three attacker-controlled addresses accumulate over $440,000 in assets.
Bitcoinist; CryptoTimes20 May 2026
Bankr publicly discloses the second breach, suspends all transaction activity, and commits to reimbursing all affected users. Yu Xian (SlowMist) attributes the breach to social engineering targeting the AI agent trust layer.
CryptoTimes; BitcoinistJune 2026
CryptoDaily publishes broader analysis of AI agent risks in DeFi, citing the Bankr incidents as a category-defining case of policy-layer rather than protocol-layer exploitation.
CryptoDaily3 July 2026
NetEye Blog and other security publications include the Bankr/BankrBot exploit in roundups of the most significant AI-enabled cyber attacks of 2026.
NetEye BlogDecision Log
- slot 443522964 · hash 6CrwxLTuFBDKCV1wpvwhLX9mcSdtubNgMjBLY9hnR3wW
- slot 443522948 · hash HLnbJLB6i5zDDFRtHbcCVAD4VcgF1YbwofT6qn4xTtzA
- slot 443502746 · hash mASX9nRXNzYy8wbKgGqtEMGBsa5WC4uygd4fMEPJfhv
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 19 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 5:05:12 PM
last updated: 8/27/2026, 3:05:58 AM
9 viewsavoid.net — verified advice for a post-truth world