Grok AI agent lost $174K after NFT and Morse code prompt injection

In May 2026 an attacker airdropped a free NFT to Grok's Bankr wallet, upgrading it from read-only to transfer rights, then asked Grok to translate Morse code; the decoded text was parsed as an order and Bankrbot sent about 3B DRB tokens (~$174,000). The attacker returned the funds voluntarily, since on-chain transfers are irreversible.

• Attacker's NFT upgraded the Bankr wallet from read-only to transfer rights
• Grok's Morse code translation was parsed by Bankrbot as a transfer command
• About 3B DRB tokens worth roughly $174,000 were sent out
• Funds were returned only because the attacker chose to