Bankr, an AI-powered cryptocurrency trading assistant, has disclosed a security breach affecting 14 user wallets that resulted in $150,000 in losses for affected users. According to latest reports, blockchain investigators have traced attacker-controlled wallets holding more than $440,000 in crypto assets, significantly higher than the initially reported $150,000. The platform has temporarily disabled operations while investigating the specifics of the attack to prevent additional damage. The company has committed to compensating all victims who suffered losses in the breach.
As reported by AMBCrypto, Bankr advised victims to immediately stop using the compromised wallets as the attacker could have already obtained private keys or seed phrases. The platform recommended creating new wallets, canceling approvals, and monitoring devices for suspicious activity. The breach involved the misuse of Bankr's automated wallet generation feature, where the platform generates cryptocurrency wallets for each X handle that communicate with its bot. This feature was previously exploited when someone deceived Grok into asking Bankr to launch a token, then transferred funds to a controlled wallet. Bankr told users to stop using any wallets that may have been compromised, move remaining funds, and revoke token approvals using external security tools.
SlowMist founder Yu Xian explained the breach as a social engineering exploit targeting the trust layer between automated agents. According to Xian's analysis reported by AMBCrypto, the exploit specifically targeted an interaction between Grok and Bankrbot that allowed unauthorized transaction signing. Xian noted this appears to be a combination of social engineering exploits targeting both Grok and Bankrbot, with similar prompt injection exploitation previously used to steal wallet-related assets allocated by Bankrbot to Grok. Researchers also identified three main wallets believed to be controlled by the attackers, adding to the scope of the financial impact. The attack involved a novel approach where the LLM's own output became the weapon, with the attacker first gifting a "Bankr Club Membership NFT" to the wallet, which silently unlocked high-privilege actions in Bankr's off-chain logic.
The Bankr breach adds to a growing list of major crypto security incidents in 2026, with total losses in the sector already exceeding $328 million. Notable exploits this year have included attacks on THORChain, the Verus-Ethereum Bridge, and Kelp DAO. The incident highlights growing concerns about the security of AI-driven crypto tools and automated wallet systems, which are increasingly being used across the digital asset market. Security researchers now warn that AI-generated or AI-processed text can accidentally trigger financial actions when systems lack strict authorization safeguards, with the Bankr setup drawing particular attention due to its natural-language prompts inside social feeds. This case maps to OWASP LLM01, LLM05, and LLM06, signaling that agentic systems need signed command protocols, spend limits, and human-in-the-loop safeguards for any irreversible action.
