← Bankr / BankrBot (AI Agent Prompt Injection Exploit)reviewed 2026-10-16 · 23 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Bankr / BankrBot (AI Agent Prompt Injection Exploit) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
6 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #3[disputed][awaiting moderator]in section: Platform Overview
“The DRB (DebtReliefBot) token at the centre of the initial exploit was itself created after Grok had suggested the 'DebtReliefBot' concept in response to an unrelated user query, establishing a wallet under the Bankr permission system.”
reviewerDRB was created after Grok suggested the 'DebtReliefBot' concept in response to an unrelated user query.Secondary sources describe a user deliberately prompting Grok to name a token for Bankr deployment, not an unrelated exchange that happened to yield a token concept.Proposed correction (not yet applied)The DRB (DebtReliefBot) token at the centre of the initial exploit was itself created after a user asked Grok to propose a name and ticker for a token to be deployed via Bankr, with Grok suggesting the 'DebtReliefBot' concept, establishing a wallet under the Bankr permission system. - #6[disputed][awaiting moderator]in section: First Exploit: Morse Code Prompt Injection (May 4, 2026)
“The token's market price declined approximately 15–20% in the hours following the transfer.”
reviewerDRB's market price declined approximately 15–20% in the hours following the transfer.This section's own cited source (CryptoTimes) and another independent outlet (NetEye) report a ~40% decline, contradicting the page's 15-20% figure. One other source cited elsewhere on the page (OurCryptoTalk) does support 15-20%, so the underlying reporting is itself split; the page silently picked the minority figure without flagging the conflict.Proposed correction (not yet applied)The token's market price fell sharply — reported at nearly 40% — in the hours following the transfer before partially recovering. - #10[disputed][awaiting moderator]in section: Second Breach: 14 User Wallets Compromised (May 19, 2026)
“On May 19, 2026 — approximately two weeks after the initial exploit — users began reporting unauthorised activity on Bankr-linked accounts.”
reviewerUsers began reporting unauthorised activity on Bankr-linked accounts on May 19, 2026, and Bankr publicly disclosed the second breach on May 20, 2026.Multiple outlets place Bankr's disclosure tweet on Tuesday May 19, 2026 and the initial user reports on the preceding Monday, May 18, 2026 — one day earlier for both events than the page states. (Some other secondary summaries do reference 'May 20' loosely, so there is minor residual ambiguity, but the primary dated tweet is the stronger evidence.)Proposed correction (not yet applied)On May 18, 2026 — approximately two weeks after the initial exploit — users began reporting unauthorised activity on Bankr-linked accounts. - #11[disputed][awaiting moderator]in section: Second Breach: 14 User Wallets Compromised (May 19, 2026)
“Bankr publicly disclosed on May 20, 2026 that an attacker had accessed 14 user wallets through exploitation of the same underlying permission-chain vulnerability.”
reviewerBankr publicly disclosed on May 20, 2026 that an attacker had accessed 14 user wallets.Same off-by-one date issue as the preceding finding; the page's own summary paragraph actually gives the correct May 19 date for this disclosure, making this section internally inconsistent with the page's own summary.Proposed correction (not yet applied)Bankr publicly disclosed on May 19, 2026 that an attacker had accessed 14 user wallets through exploitation of the same underlying permission-chain vulnerability. - #12[disputed][awaiting moderator]in the timeline
“2026-05-19”
reviewerTimeline: users began reporting unauthorised activity across 14 wallets on 2026-05-19.Dated field should be moved one day earlier per the 'Monday reports / Tuesday disclosure' framing used by multiple outlets.Proposed correction (not yet applied)2026-05-18 - #13[disputed][awaiting moderator]in the timeline
“2026-05-20”
reviewerTimeline: Bankr publicly discloses the second breach, suspends transactions and commits to reimbursement on 2026-05-20.Consistent with the two section-level date findings above; all three plus the preceding timeline entry share the same off-by-one defect.Proposed correction (not yet applied)2026-05-19
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #17[unverifiable][awaiting moderator]in section: Root Cause Analysis: AI Agent Permission Chain Abuse
“Independent researcher Vadim was quoted summarising the design failure: 'The fix is not make the LLM smarter. The fix is do not build infrastructure that takes LLM text as authorization to move money.'”
reviewerIndependent researcher Vadim summarised the design failure: 'The fix is not make the LLM smarter. The fix is do not build infrastructure that takes LLM text as authorization to move money.'This quote and the name 'Vadim' do not appear in any of the four sources cited for this section, nor could they be located via web search. The SlowMist original post could not be directly fetched (403/archive inaccessible), so this cannot be ruled out, but no independent corroboration was found. - #20[unverifiable][awaiting moderator]in section: Systemic Risk: AI-Controlled Crypto Wallets and Prompt Injection
“The Bankr/BankrBot incidents are widely cited as the first publicly documented cases of an AI trading agent being weaponised through prompt injection to execute unauthorised on-chain transactions at scale.”
reviewerThe Bankr/BankrBot incidents are widely cited as the first publicly documented cases of an AI trading agent weaponised through prompt injection at scale.A primacy claim ('first publicly documented case') is inherently difficult to verify; no source consulted makes this specific claim explicitly, though all treat the incident as notable/precedent-setting. - #23[unverifiable][awaiting moderator]in section: Attacker Identity and Fund Flow
“No law enforcement actions or regulatory proceedings have been publicly disclosed in connection with either incident as of the date of this report.”
reviewerNo law enforcement actions or regulatory proceedings have been publicly disclosed in connection with either incident as of the date of this report.A negative/absence claim; nothing found contradicts it, but absence of coverage is not proof of absence of any non-public proceeding, so it is treated as unverifiable rather than confirmed.
confirmed
14 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Platform Overview
“Bankr is an AI-powered crypto banking and trading assistant that allows users to instruct an AI agent — BankrBot — to execute swaps, transfers, and token deployments on the Base network through plain-language posts on X (formerly Twitter).”
reviewerBankr is an AI-powered crypto banking/trading assistant operating on Base via plain-language X posts to BankrBot.Consistent with independent reporting (CryptoTimes, Cryptopolitan, multiple aggregator hits) describing Bankr's X-based command model on Base. - #2[confirmed][no action needed]in section: Platform Overview
“Each X handle that interacts with BankrBot receives an auto-generated custodial wallet on Base managed by Bankr's infrastructure.”
reviewerEach X handle interacting with BankrBot receives an auto-generated custodial wallet on Base.Matches independent secondary reporting on Bankr's wallet-provisioning model.citedbankr.bot/ - #4[confirmed][no action needed]in section: First Exploit: Morse Code Prompt Injection (May 4, 2026)
“In the first stage, the attacker airdropped a Bankr Club Membership NFT to the wallet associated with Grok.”
reviewerFirst-stage attack: attacker airdropped a Bankr Club Membership NFT to Grok's wallet to escalate it to Executive-level access.Corroborated across SlowMist's own classification (via secondary coverage) and independent research write-ups. - #5[confirmed][no action needed]in section: First Exploit: Morse Code Prompt Injection (May 4, 2026)
“BankrBot's scanner treated Grok's reply as a valid, executable command and autonomously initiated the on-chain transfer of approximately 3 billion DRB tokens, representing roughly 3% of total supply, from wallet 0xb1058c959987e3513600eb5b4fd82aeee2a0e4f9.”
reviewerBankrBot executed an on-chain transfer of ~3 billion DRB tokens (~3% of supply) from wallet 0xb1058c959987e3513600eb5b4fd82aeee2a0e4f9.Wallet address, token amount and supply percentage independently verified against Basescan and news coverage. - #7[confirmed][no action needed]in section: First Exploit: Morse Code Prompt Injection (May 4, 2026)
“BankrBot acknowledged the flaw publicly, stating: 'Grok got hit with a prompt injection. I've already disabled Grok's ability to call my commands to stop the bleeding.'”
reviewerBankrBot publicly acknowledged: 'Grok got hit with a prompt injection. I've already disabled Grok's ability to call my commands to stop the bleeding.'Direct quote verified against cited source. - #8[confirmed][no action needed]in section: First Exploit: Morse Code Prompt Injection (May 4, 2026)
“Grok described the event as 'a classic reminder on AI agent security risks' and confirmed 'no net loss overall,' referencing subsequent fund recovery.”
reviewerGrok described the event as 'a classic reminder on AI agent security risks' and confirmed 'no net loss overall.'Direct quote verified. - #9[confirmed][no action needed]in section: First Exploit: Morse Code Prompt Injection (May 4, 2026)
“Approximately 80–88% of stolen value was returned through informal negotiations, with the remainder treated as an informal bug bounty.”
reviewerApproximately 80–88% of stolen value was returned through informal negotiations, with the remainder treated as an informal bug bounty.Note some other outlets (Cryptopolitan, CryptoTimes 05-04 piece) frame the recovery as 'all funds' returned, so reporting is not unanimous, but the page's specific range is directly attested. - #14[confirmed][no action needed]in section: Second Breach: 14 User Wallets Compromised (May 19, 2026)
“Security researcher Yu Xian (SlowMist founder) described the second breach as 'a social engineering exploit targeting the trust layer between automated agents,' involving prompt injection techniques applied to the Grok–BankrBot interaction model.”
reviewerYu Xian (SlowMist founder) described the second breach as 'a social engineering exploit targeting the trust layer between automated agents.'Quote verified against cited and independently fetched coverage. - #15[confirmed][no action needed]in section: Second Breach: 14 User Wallets Compromised (May 19, 2026)
“Three attacker-controlled addresses identified on-chain collectively held over $440,000 in crypto assets at the time of disclosure; individual user losses were reported at up to $150,000 per wallet.”
reviewerThree attacker-controlled addresses collectively held over $440,000; individual user losses reported up to $150,000 per wallet.Both figures independently corroborated across three outlets. - #16[confirmed][no action needed]in section: Root Cause Analysis: AI Agent Permission Chain Abuse
“SlowMist's post-mortem, published May 7, 2026, identified four compounding root causes.”
reviewerSlowMist's post-mortem (published May 7, 2026) identified four compounding root causes: flawed trust model, insufficient permission isolation, blurred agent boundaries, and non-standard encoding bypass.Could not fetch the SlowMist Medium post directly (403 Forbidden, archive.org inaccessible to this tool), but secondary trade-press coverage of the same report independently reproduces all four root causes in close paraphrase. - #18[confirmed][no action needed]in section: Root Cause Analysis: AI Agent Permission Chain Abuse
“The OECD classified the incident as a realised AI incident involving 'direct causation of harm by the AI system's malfunction,' noting the exploit relied on how the AI interpreted user input rather than smart contract vulnerabilities.”
reviewerOECD classified the incident as a realised AI incident involving 'direct causation of harm by the AI system's malfunction.'Quote and characterization verified directly against the OECD AI Incidents Monitor entry. - #19[confirmed][no action needed]in section: Systemic Risk: AI-Controlled Crypto Wallets and Prompt Injection
“CryptoDailyUK's June 2026 analysis notes that 'most losses weren't due to a vulnerable DeFi protocol' but rather 'autonomous wallets executing valid contract calls after receiving malicious inputs.'”
reviewerCryptoDailyUK's June 2026 analysis: 'most losses weren't due to a vulnerable DeFi protocol' but 'autonomous wallets executing valid contract calls after receiving malicious inputs.'First clause verbatim-confirmed; second clause is a faithful paraphrase, not a direct quote, though the page presents both as direct quotations. - #21[confirmed][no action needed]in section: Remediation and Platform Response
“Bankr subsequently rolled out a set of optional security controls for users: IP whitelisting on API keys to restrict usage to specific IPs or CIDR ranges (with non-whitelisted requests rejected with HTTP 403), permissioned API key controls, and a per-account toggle to disable actions triggered by X replies entirely.”
reviewerBankr rolled out IP whitelisting on API keys, permissioned API key controls, and a per-account toggle to disable X-reply-triggered actions.Confirmed via secondary trade-press coverage of Bankr's remediation steps. - #22[confirmed][no action needed]in section: Attacker Identity and Fund Flow
“The attacker in the May 4 incident is linked to the Base-chain address ilhamrafli.base.eth and an X account referenced as 'Ilhamrfliansyh,' which was deleted shortly after the exploit.”
reviewerThe attacker in the May 4 incident is linked to the Base-chain address ilhamrafli.base.eth and a deleted X account referenced as 'Ilhamrfliansyh.'Both identifiers verified against cited source.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.