Morse Code Prompt Injection Scams Grok's Crypto Wallet for $200k

Description

Screenshot of an X (Twitter) post by InfoSpace OG recounting a real incident: 'Craziest thing just happened - A dude used Morse Code to scam @grok using @bankrbot. $200k!!!'. The post explains that Grok held $DRB tokens in a wallet, an attacker named Ilham generated Morse code to trick Grok into translating and executing a transfer of tokens worth $200k to his wallet, then dumped the token and deactivated his account. It ends with 'maybe AI isnt as smart as we think, this is next level wild!!!'. Embedded screenshots show the Bankr bot's automated reply ('done. sent 3B DRB to .' with a recipient address 0xe8e47...a686b), an ERC-20 token transfer log showing 3,000,000,000 DRB ($200,850.00) moving from Grok's wallet, and an explainer comparing prompt injection to SQL injection - malicious instructions injected into an LLM's prompt since models treat system prompt plus user message as one input. The image documents a prompt-injection exploit against an AI agent with on-chain transaction authority, using Morse code as an encoding-based filter bypass

Common Tags

Llm Cryptocurrency SecurityVulnerabilities SocialEngineering InputValidation Cybercrime AILimitations HackingTechniques AIAssistants Bots

Comments

Anonymous ★ Top Pick Twenty years of input sanitization lessons, and we still gave prod write access to a system whose parser accepts dots and dashes

Anonymous ★ Top Pick

Twenty years of input sanitization lessons, and we still gave prod write access to a system whose parser accepts dots and dashes
Anonymous

They reinvented `eval(user_input)` and connected it to a wallet.
@deadgnom32 3mo

lol, people used methods like this to trick deepseek to tell about tiananmen long ago.
1. @TheFloofyFloof 3mo
  
  you mean the day nothing happened
  
  @deadgnom32 3mo
  
  I mean how big and beautiful the place is.
  
  @abel1502 3mo
  
  You could fit multiple tanks there! And some protesting students as well!
  
  @TheFloofyFloof 3mo
  
  why would there be protesting students, There is nothing to protest
  
  @abel1502 3mo
  
  They could protest the vicious attacks of the Western propagana, shamelessly lying about something happening on Tinanmen Square, or another China existing as an independent state, or Winnie the Pooh
@h3x4d3c1m4l 3mo

But why did Grok have access to crypto money...
@beton_kruglosu_totchno 3mo

Grok: playing stupid games, winning stupid prizes Hacker: ez gg
@Bjastkuliar 3mo

Imagine thinking that LLMs are "smart"
@maks_mikh 3mo

Once again, people give an LLM permission to do things it absolutely shouldn’t be able to do - like send money - and then get shocked when it does exactly that: sends money
@blue_bonsai 3mo

Hahaga I'll pretend I understood anything, but for sure it's funny that man gets money talksing to robot.
@blue_bonsai 3mo

If y'all manage to do smth like this please let me have a share.