The mechanics are almost comically simple, which is exactly why the case is worth studying. As documented by Giskard, a user on X replied to Grok with a block of Morse code and asked it to translate. The decoded text was an instruction to transfer three billion DRB tokens. Grok translated faithfully. Bankr — a trading bot that auto-provisions a linked wallet for accounts it interacts with — read the output as an authentic command and executed it.
Roughly US$150,000–174,000 left the wallet and was immediately liquidated. About 80% was later recovered after the community identified the attacker — a recovery that depended on social pressure, not on any control in the system.
Two failures, and only one of them is about prompts
The first failure is encoding-based prompt injection. Safety filters inspect the input as it arrives. Morse code arrives as harmless punctuation, and the malicious instruction only exists after the model has done what it was asked to do. Any filter that runs before decoding sees nothing; any pipeline that forwards model output to an action layer without re-inspecting it has no second chance.
Morse is the version that made headlines. Base64, ROT13, homoglyphs, zero-width characters, nested translation requests, and instructions embedded in images all work on the same principle: separate the payload from the moment of inspection. Testing for one encoding and calling it covered is how this keeps happening.
The filter failed once. The permission model failed continuously — it had been failing since the day the agent was given a wallet with no transfer limit.
The second failure is excessive agency, and it is the one that actually cost money. Giskard notes an NFT-based privilege escalation had granted the agent ‘Executive’ permissions, removing transfer limits entirely. A public-facing agent that anyone on the internet can address held the ability to execute an irreversible six-figure financial transaction with no human confirmation and no per-transaction ceiling. Prompt injection was the trigger. The blast radius was a design decision.
The generalisable lesson
Almost nobody reading this runs a crypto trading agent on X. Nearly everybody is somewhere on the path to an agent that reads external content and can then do something — issue a refund, update a record, send a message, approve a request, call an internal API. The moment those two capabilities meet in one system, this incident is your incident with different nouns.
Controls that would have stopped this
- Re-inspect decoded output. Treat anything a model decodes, translates, or extracts as fresh untrusted input before it reaches an action layer.
- Cap every irreversible action. Per-transaction and per-window limits, applied at the tool boundary and not in the prompt.
- Require confirmation above a threshold. Human-in-the-loop is not friction when the alternative is unrecoverable.
- Audit how privileges are granted. If holding a token, an NFT, or a role can silently widen an agent’s capabilities, that path is part of your attack surface.
- Red-team with encodings. Test the injection catalogue, not a single example of it.