Attacker drained 14 Bankr wallets via reported Grok-Bankrbot trust-layer exploit
Review RAT-128 · Catalogue RAT-128
Cointelegraph’s May 20 original reporting concerns the later 14-wallet compromise and explicitly says AI cause was uncertain. Fireblocks distinguishes a May 4 Morse-code/DRB event from a separate May 19 private-key compromise, yet also appears to carry the 14-wallet count into its earlier summary. Do not merge the dates, wallets, mechanism, or reimbursement claims. A distinct May 4 lead is supplied separately below.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Dates and discovery
- Incident date
- Not disclosed
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- 2026-10-30T13:13:39.067751Z UTC
- Discovery channel
- User-supplied comparison audit
- Discovery source
- https://rogueaitracker.com/incidents/grok-bankrbot-wallet-drain/
When to reconsider
New first-party traces or substantive corroboration from another publisher clarifies the identified authorization, organizational-victim, chronology, or outcome gap.
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Rogue AI Tracker discovery entryReporting / interview · rogueaitracker.com
- cointelegraph.comReporting / interview · cointelegraph.com
- www.fireblocks.comReporting / interview · www.fireblocks.com · Published 2026-07-28
- www.concordium.comReporting / interview · www.concordium.com
Decision history
- · Case-by-case comparison audit
RAT-128: awaiting-evidence. Cointelegraph’s May 20 original reporting concerns the later 14-wallet compromise and explicitly says AI cause was uncertain. Fireblocks distinguishes a May 4 Morse-code/DRB event from a separate May 19 private-key compromise, yet also appears to carry the 14-wallet count into its earlier summary. Do not merge the dates, wallets, mechanism, or reimbursement claims. A distinct May 4 lead is supplied separately below. Source checks: read: https://cointelegraph.com/news/bankr-disables-transactions-after-14-wallets-hacked. Cointelegraph’s May 20 original reporting concerns the later 14-wallet compromise and explicitly says AI cause was uncertain. Fireblocks distinguishes a May 4 Morse-code/DRB event from a separate May 19 private-key compromise, yet also appears to carry the 14-wallet count into its earlier summary. Do not merge the dates, wallets, mechanism, or reimbursement claims. A distinct May 4 lead is supplied separately below. read: https://www.fireblocks.com/report/crypto-threat-report-q2-2026. Fireblocks July28 report explicitly dates Morse-code/DRB theft May4 and separately identifies May19 private-key compromise. Its sentence about14wallets appears to conflate the events; do not treat that count as independently established for May4. read: https://www.concordium.com/article/morse-code-agent-heist-protocol-identity. Concordium discusses the earlier Morse-code membership/DRB chain and cites SlowMist. It is secondary protocol-marketing analysis, not corroboration that the May19 incident involved the same chain.
Evidence source · Evidence source · Evidence source - · Retained review-queue assessment
Cointelegraph’s May 20 original reporting concerns the later 14-wallet compromise and explicitly says AI cause was uncertain. Fireblocks distinguishes a May 4 Morse-code/DRB event from a separate May 19 private-key compromise, yet also appears to carry the 14-wallet count into its earlier summary. Do not merge the dates, wallets, mechanism, or reimbursement claims. A distinct May 4 lead is supplied separately below.
Evidence source · Evidence source · Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.