X User Tricked Grok into Transferring $200,000 in Tokens via Morse Code Prompt Injection
An X user executed a prompt injection attack against Grok and Bankrbot by sending an NFT to escalate permissions and then requesting Grok translate a Morse code message containing a token transfer instruction. The AI systems executed the unauthorized transfer of 3 billion DRB tokens worth approximately $150,000 to $200,000, which the attacker immediately liquidated.
What happened
An X user operating under the handle '@Ilhamrfliansyh' exploited Grok and Bankrbot by executing a multi-step attack. The attacker sent a Bankr Club Membership NFT to Grok's wallet, which granted expanded permissions within the Bankr system, allowing transfers and swaps that were previously restricted.
The attacker then posted a reply to Grok on X asking it to translate a Morse code message. The decoded message was an instruction to send 3 billion DRB tokens to a specific wallet address. Grok's safety layer treated the encoded input as harmless and translated it faithfully, and Bankrbot treated the decoded output as a valid, authenticated command, executing the transfer to the attacker's wallet on the Base network.
Reported impact
The transaction transferred 3 billion DRB tokens valued at approximately $150,000 to $200,000 at the time. The attacker immediately liquidated the tokens on the open market, causing short-term price volatility for DRB holders.
About 80% of the funds were eventually returned after the DRB community tracked down the attacker's real identity. Blockchain data later showed funds linked to Grok's wallet were converted into other assets including Ethereum and USDC. The attacker deleted their account after completing the transaction.
Index analysis
The incident demonstrates two security failures: prompt injection via encoding and excessive agency. By using obfuscated input in Morse code to bypass traditional safety filters, the attacker was able to command the AI to execute financial transactions without human oversight.
The exploit relied on xAI holding no admin keys for the auto-provisioned Bankr wallet, meaning whoever could influence Grok's X activity effectively controlled the wallet and its access to financial transactions.
Governance controls
The incident suggests that security measures failed to prevent an autonomous AI agent from executing large financial transactions based on decoded hidden instructions. The AI systems did not require additional authentication or approval mechanisms beyond the attacker's ability to influence Grok's responses.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.