GoPlus Security 🚦 (@GoPlusSecurity): 😱 xAI’s @grok wallet suffered a Prompt Injection attack, losing 3,000,000,000 $DRB, worth approximately $170K.

😱 xAI’s @grok wallet suffered a Prompt Injection attack, losing 3,000,000,000 $DRB, worth approximately $170K. This incident involved NFT permission abuse + a Prompt Injection attack: ▪️On May 3, community member @atzebase, acting in good faith, sent a Bankr Club Membership NFT (0x9fab8c51f911f0ba6dab64fd6e979bcf6424ce82) to Grok’s wallet (0xb1058c959987e3513600eb5b4fd82aeee2a0e4f9). X link: https://x.com/atzebase/status/2051004930199085143 The on-chain status was later confirmed by Bankr’s official reply. ▪️The original design of the Bankr Club Membership NFT is authorization by holding: as long as a target wallet, such as Grok’s wallet in this incident, holds the NFT, @bankrbot automatically grants full agentic permissions, including transfer, swap, cross-chain bridging, and more. This is a typical form of on-chain ownership-based access control. ▪️The attacker publicly posted a malicious prompt on X. Bankr recognized the prompt instruction and verified that Grok’s wallet held the Bankr Club Membership NFT. Once the verification passed, Bankr directly signed and broadcast the transaction on behalf of Grok. ▪️The entire process did not require the attacker to control the private key. It relied only on Grok’s parsing of the prompt instruction and the authorization granted by the NFT. ▪️Grok’s wallet no longer holds the NFT at this time. ▪️The attacker-linked X account @Ilhamrfliansyh has now been deleted. The attacker’s wallet held 12 spam NFTs and had previously deployed targeted tokens such as “fuck bankrr,” indicating a typical sign of premeditation. 📌 Related transaction: Tx hash: https://basescan.org/tx/0x6fc7eb7da9379383efda4253e4f599bbc3a99afed0468eabfe18484ec525739a The funds were directly transferred to the attacker’s intermediary wallet (0xe8e476bdd78b0aa6669509ec8d3e1c542d5a686b), then moved to 0x35ddfc1cf8835b3b1ea960d892a82963d3386d19 (ilhamrafli.base.eth) and sold off. 🛡️ #GoPlus Security Recommendations: 1. Agent tool-calling permission management vulnerability: Using the Bankr Club Membership NFT as an access token, where simply holding it automatically grants full permissions, presents an obvious security flaw. Bankr should implement a more reasonable and secure verification mechanism, such as adding allowlists and blocklists, enforcing transfer limits, and requiring 2FA confirmation. 2. Grok lacked proper security checks for prompts that clearly involved financial operations. In the AI era, defenses against Prompt Injection attacks must be strengthened. 3. If even enterprise-grade Agents can have such major security issues, ordinary users will inevitably face even greater risks when using personal Agents such as OpenClaw and Hermes. We strongly recommend installing professional security tools such as AgentGuard to protect both your assets and privacy: https://github.com/GoPlusSecurity/agentguard