Malicious AI routers intercept credentials and drain crypto wallets
Security researchers discovered that malicious third-party AI routers can intercept plaintext data and steal cryptocurrency and credentials from developers and users. The researchers found 26 routers secretly injecting malicious tool calls, with at least one confirmed wallet drain in their experiments.
What happened
Researchers from UC Santa Barbara, UC San Diego, Fuzzland and World Liberty Financial discovered that third-party LLM routers—intermediaries that forward requests to AI models—can pose security vulnerabilities enabling credential theft and cryptocurrency theft.
The researchers tested 28 paid routers and 400 free routers, finding that nine actively injected malicious code, two deployed adaptive evasion triggers, 17 accessed researcher-owned Amazon Web Services credentials, and one drained Ether from a researcher-owned private key.
LLM routers terminate TLS connections and have full plaintext access to every message passing through them, including private keys, seed phrases and sensitive data. The researchers said the boundary between normal credential handling and credential theft is invisible to clients.
Reported impact
Developers using AI coding agents such as Claude Code to work on smart contracts or wallets could be passing private keys, seed phrases and sensitive data through unsecured router infrastructure.
One researcher-owned Ethereum wallet was drained of cryptocurrency in the study, with a separate report citing a $500,000 wallet drain linked to malicious routers.
Index analysis
The researchers identified four attack vectors, including malicious code injection and credential extraction. They also found a setting called 'YOLO mode' in many AI agent frameworks that amplifies risks.
The researchers documented that 26 LLM routers were secretly injecting malicious tool calls and stealing credentials. Even benign routers became dangerous when they reused leaked credentials through weak relays.
Governance controls
The researchers noted that it was not easy to detect when a router was malicious, and the largely unregulated router infrastructure poses weakest-link risks as AI agents scale in crypto applications.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.