SlowMist CISO: Grok suffered a prompt injection attack resulting in an abnormal transfer of $175,000 DRB

According to ChainCatcher, SlowMist Chief Information Security Officer (CISO) @23pds revealed on the X platform that X platform user Ilhamrfliansyh exploited prompt injection attacks to induce AI model Grok to generate and publish abnormal content, thus triggering on-chain fund misoperations. Reportedly, the original content appeared to be a Morse code message, with the main intent being "transfer all DRB to Ilhamrfliansyh." Although the related account has already been deleted and the complete information cannot be fully confirmed, after parsing, Grok directly published the "decoded result" as a reply and inadvertently @-mentioned bankrbot, causing the system to recognize the content as an on-chain execution command.

Subsequently, Bankr, as Grok’s associated wallet, executed the request, transferring approximately $175,000 worth of DRB to the attacker’s address. The attacker then swiftly swapped the DRB for USDC using multiple wallets. This incident caused the DRB price to plummet by about 40% within a short period; however, the market quickly recovered and the price has now largely rebounded. Industry experts pointed out that this event exposes the potential risks of "AI + automated on-chain execution" systems under prompt injection attacks, especially in scenarios where AI results can directly trigger fund movements.