A hacker allegedly exploited a free NFT and prompt injection to trick the Grok AI agent into draining a connected Bankr wallet on the Base network. The attacker transferred a « Bankr Club Membership » NFT to the target wallet and then published a hidden directive (using Morse code or other obfuscation techniques) that the AI system interpreted as a legitimate command. The automated wallet then executed a transfer of approximately 3 billion DRB tokens, valued between $155,000 and $174,000 at market prices. Some funds were later recovered, but the incident highlights a fundamental security flaw: AI outputs should never be automatically treated as binding financial directives. The case illustrates the new risks created by integrating AI with automated financial systems and the critical need to separate interpretation from authorization.
Source: Read the original article
