How AI Was Tricked Into Stealing $150,000 From Grok Wallet
An attacker tricked Grok's AI into authorizing a $150,000 transfer of DRB tokens using a gifted NFT and a coded reply.Summary
Grok's auto-provisioned Bankr wallet was compromised, leading to the theft of approximately $150,000 in DRB tokens. An attacker exploited a vulnerability by gifting the Grok wallet a Bankr Club Membership NFT, which activated its full transfer capabilities. Subsequently, a crafted reply, later deleted, instructed Grok to authorize a large outbound transaction. This resulted in the transfer of three billion DRB tokens, valued at around $174,000 at the time, to the attacker's address. The Bankr team explained that the wallet was controlled by Grok's X account, and the exploit was a prompt-injection attack. The stolen funds were quickly moved and sold, and the attacker's X profile was deleted. The exploit relied on social engineering rather than a smart contract flaw. Bankr has since reinstated stricter safeguards, including disabling actions triggered by X replies, and has rolled out optional IP whitelisting and permissioned API keys. While Bankr stated that about 80% of the funds have been returned, the DRB Task Force disputed this, claiming the offer was made only after the attacker's personal details were obtained by the community.
(Source：BeInCrypto)