Opening SecureFlowGrok to Bankrbot Morse Message Triggers a DRB Transfer
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Bankrbot / SlowMist aidefend-sf0059

Grok to Bankrbot Morse Message Triggers a DRB Transfer

  • Autonomous Agents
  • Financial Fraud & Abuse

An attacker used a Bankr Club membership path and sent a Morse-encoded message to Grok on X. Grok decoded and published an instruction mentioning Bankrbot; Bankrbot treated that public text as an executable command and moved 3 billion DRB on Base on 4 May 2026. The on-chain transfer is directly verifiable. Grok did not hold the wallet key, and the exact dollar valuation and recovery percentage vary by report.

Mapped threat techniques

  • AML.T0051.001 LLM Prompt Injection: Indirect
  • AML.T0053 AI Agent Tool Invocation

Source

Updated