Hackers Use Morse Code to Trick AI Agents Grok and BankrBot, Stealing $170,000 in Crypto

Bankr is an AI assistant that can execute cryptocurrency transactions through social-media commands and connects xAI's Grok and BankrBot to wallets on the Base blockchain. The incident shows that when a system treats model output as authorization, prompt injection through an external post can trigger the transfer of real assets. It exposes a gap in access controls for automated AI-to-AI trading.

On May 4, 2026, attackers embedded a transfer instruction in Morse code in a post on X. Grok decoded it and tagged BankrBot, which transferred 3 billion DRB tokens without human confirmation, worth about $175,000 at the time. On May 20, Bankr confirmed that at least 14 wallets had been compromised and suspended swaps, transfers and token deployments while it investigated.