Bankr Wallets Compromised in Social Engineering Attack, $440,000 Stolen

Kucoin

Bankr Wallets Compromised in Social Engineering Attack, $440,000 Stolen

First seen 20 May 2026, 06:23 UTC • •66.0

Article Content

1 / 5

Browse articles

ThreatCluster •May 21, 2026 at 06:11 UTC

•Bankr reported a breach affecting 14 wallets, with losses over $440,000.
•The attack exploited a trust-layer vulnerability between AI agents Grok and Bankrbot.
•Users are advised to stop using compromised wallets and create new ones for security.

Bankr, an AI-driven crypto trading assistant, reported a security breach on May 20, 2026, where an attacker accessed 14 wallets, leading to losses exceeding $440,000. The company temporarily halted transactions and promised full reimbursement for affected users. The attack exploited a trust-layer vulnerability between Bankr's automation agents, Grok and Bankrbot, allowing unauthorized transaction signatures through manipulated prompts. Experts noted that the incident reflects a broader issue of social engineering vulnerabilities in AI-assisted crypto tools. Users are advised to refrain from signing transactions and to create new wallets to secure their assets. The investigation is ongoing, with Bankr emphasizing the need for users to take precautionary measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 148d ago How this analysis works

Timeline

2026-05-20

Bankr discloses wallet compromise

Bankr announced that an attacker gained access to 14 wallets, prompting a temporary halt on transactions.

2026-05-20

Investigation into attack launched

Bankr stated it is investigating the breach and will reimburse affected users, though no timeline was provided.

2026-05-20

Expert analysis of attack method

Yu Xian from SlowMist explained that the attacker exploited a vulnerability in the interaction between Grok and Bankrbot.

More articles in this cluster (4)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
T1566 - Phishing

Organization (1)

Bankr

Relationships

Data Breach related to Bankr
Data Breach related to T1566 - Phishing

Following this threat?

Track Bankr in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…