Grok AI targeted by prompt injection attack; 175,000 DRB stolen

ChainCatcher report: SlowMist’s Chief Information Security Officer (CISO), @23pds, disclosed on X that user Ilhamrfliansyh used a prompt injection attack to manipulate the AI model Grok into generating and posting anomalous content, triggering an on-chain fund misoperation. The original content is believed to have been a Morse code message whose core meaning was “transfer all DRB to Ilhamrfliansyh.” Although the associated account has since been deleted and the full details cannot be fully verified, Grok parsed the content and directly published the “decoded result” as a reply, inadvertently mentioning @bankrbot, causing the system to interpret it as an on-chain execution command. Subsequently, Bankr, the wallet associated with Grok, executed the request, transferring approximately $175,000 worth of DRB to the attacker’s address. The attacker then rapidly exchanged the DRB for USDC across multiple wallets. The incident caused DRB’s price to briefly plummet by around 40%, but the market quickly recovered, and the price has since largely regained its losses. Industry experts note that this event highlights the potential risks of “AI + automated on-chain execution” systems under prompt injection attacks, particularly in scenarios where AI-generated outputs can directly trigger fund transfers.