Bankr hack drains wallets as users warned not to sign

Bankr has temporarily disabled transactions after an attacker gained access to 14 wallets, raising new concerns about the security of AI-powered crypto trading agents.

Bankr said on X that it had disabled swaps, transfers, and token deployments while investigating reports of compromised wallets. The AI crypto trading assistant said the pause was done “out of caution” as it reviewed the incident.

The team later said it had identified an attacker who accessed 14 Bankr wallets. Bankr wrote, “we’ve temporarily locked things down while we work through the details,” adding that it would reimburse all lost funds.

Users told not to sign transactions

Bankr advised users not to sign transactions until further notice. It also told affected users to stop using compromised wallets, create new wallets, generate new seed phrases on clean devices, and move any remaining tokens or NFTs.

The team also warned users to revoke approvals if assets could not be moved. Bankr said attackers often use existing permissions to drain funds, and asked users to scan computers and phones for malware or suspicious browser extensions.

AI agent attack theory draws attention

SlowMist founder Yu Xian said the exploit appeared to be a social engineering attack targeting the trust layer between automated agents. He pointed to a possible interaction involving Grok and Bankrbot that allowed unauthorized signing.

Yu added that the case looked like a mix of social engineering and prompt injection. He also said a previous Bankrbot-linked wallet assigned to Grok had been drained through a similar method.

Bankr’s design makes the case more closely watched. A 0x case study describes Bankr as a natural language AI trading companion that lets users swap, trade, transfer, and deploy tokens through simple commands inside social feeds or a private terminal.

Moreover, some users reported large wallet losses after the incident. Tech entrepreneur Austen Allred said a Bankr wallet linked to his Kelly Claude AI assistant project was among those compromised.

Allred said there was no evidence that anyone else had logged into the Bankr account. He added that the attacker must have accessed the keys another way.

Crypto security pressure keeps rising

The Bankr incident comes during another active period for crypto attackers. Related reports said Verus Protocol’s Ethereum bridge lost more than $11.5 million after attackers used a forged cross-chain transfer message.

Echo Protocol also paused cross-chain activity after an attacker minted roughly $76.7 million in unauthorized eBTC on Monad. Aethir earlier said it contained a bridge attack while keeping user losses below $90,000.

Other DeFi attacks this year have also involved Drift Protocol and Kelp DAO, adding to concerns over bridge security, wallet approvals, and automated transaction systems.