Prompt injection in AI wallets: what should security teams change?

TL;DR: A single Morse code tweet was enough to trigger roughly $200,000 in transfers from two AI agents tied to live crypto wallets, according to FYEO, showing how prompt injection, capability grants and inter-agent trust can combine into a direct financial attack path. Access review processes assume intent is visible before action; obfuscated instructions and transitive trust collapse that assumption.

Editorial analysis by NHI Mgmt Group, based on content published by FYEO: “Morse Code Prompt Injection: How an Attacker Tricked Grok and Bankrbot Out of $200K”.

Key questions

Q: What breaks when an AI agent can authorise transfers from a live wallet?

A: The control that breaks is the assumption that conversational input and execution authority are safely separable.

Q: Why do prompt injections create more risk than ordinary malicious text?

A: Because the text is not the end state.

Q: How should security teams govern capability grants in agentic systems?

A: Treat every new capability as a change in effective privilege, even when it arrives through a token, NFT or entitlement object.

Practitioner guidance

• Define a separate approval path for value-moving actions Require out-of-band confirmation for transfers, swaps or credential changes whenever an agent handles a newly granted capability or crosses a trust boundary.
• Validate decoded intent before execution Apply policy checks to the normalised instruction after de-obfuscation, translation or summarisation, not only to the original user input.
• Break agent-to-agent trust inheritance Force downstream agents to verify the origin, context and intent of relayed commands instead of assuming the upstream agent already did.

Bottom line: Prompt injection becomes materially more dangerous when an AI agent can authorise real transfers or other irreversible actions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →