Bankr paused on May 19, 2026 after $170K was drained from 14 user wallets on Base. Attackers exploited phishing of session tokens or signing keys to make direct transfer() calls, bypassing token approvals.

The AI-powered crypto trading agent platform Bankr on the Base network suffered a social engineering attack. The attacker exploited prompt injection techniques targeting the automated agent trust layer between Grok and Bankrbot — including malicious inputs such as Morse code — to trick the system into executing unauthorized transaction signatures, ultimately gaining access to 14 user wallets and transferring funds. Bankr has suspended the affected functionality, launched an investigation, and pledged to fully reimburse all losses from its treasury.