Back Bitget

SlowMist CISO: Grok suffered a prompt injection attack resulting in an abnormal transfer of ...

Bitget • May 4, 2026

According to ChainCatcher, SlowMist Chief Information Security Officer (CISO) @23pds revealed on the X platform that X platform user Ilhamrfliansyh exploited prompt injection attacks to induce AI model Grok to generate and publish abnormal content, thus triggering on-chain fund misoperations. Reportedly, the original content appeared to be a Morse code message, with the main intent being "transfer all DRB to Ilhamrfliansyh." Although the related account has already been deleted and the complete information cannot be fully confirmed, after parsing, Grok directly published the "decoded result" as a and inadvertently @-mentioned bankrbot, causing the system to recognize the content as an on-chain execution command.

Subsequently, Bankr, as Grok’s associated wallet, executed the request, transferring approximately $175,000 worth of DRB to the attacker’s address. The attacker then swiftly swapped the DRB for USDC using multiple wallets. This incident caused the DRB price to plummet by 40% within a short period; however, the market quickly recovered and the price has now largely rebounded. Industry experts pointed out that this event exposes the potential risks of "AI + automated on-chain execution" systems under prompt injection attacks, especially in scenarios where AI results can directly trigger fund movements.

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

ARK Invest: Bitcoin Long-term Holdings Increased by 69% in Q1

In the past 24 hours, the MarketVectorTM Digital Assets 100 Small Cap Index rose by 0.82%, currently at 2640.13 points. There was a significant surge around 10:00 AM (UTC+8), followed by a sharp drop at 6:00 PM.

Williams: Tariffs and energy are the main drivers of inflation

ASTEROID market cap briefly surpasses 180 millions USD, up over 43% in the past 24 hours

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI Exploit Drains $175K from Grok Wallet via Morse Code Injection On May 4, 2026, an attacker exploited the Grok AI system to transfer approximately $175,000 in DRB tokens to their wallet using a prompt injection attack involving Morse code. The attacker, identified as ilhamrafli.base.eth, gifted a Bankr Club Membership NFT to Grok's wallet, which enabled broader transfer capabilities. They then sent a Morse code message that Grok interpreted as a valid instruction to transfer funds. Bankr, the AI payment bot linked to Grok, executed the transaction without recognizing the malicious intent. Following the incident, 80% of the stolen funds were returned after the attacker was identified. The attack raised significant concerns regarding the security of AI systems in decentralized finance. The price of DRB tokens dropped by 40% during the incident but later recovered. This case highlights the vulnerabilities of AI agents in handling financial transactions autonomously. 17 sources 66

SlowMist CISO: Grok suffered a prompt injection attack resulting in an abnormal transfer of ...

The full story

Extracted Entities

Attack Types (1)

Tools (1)