May 13, 2026
0 new drains, 2 updates.
Updated
-
Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet
On 4 May 2026 an attacker drained about 3 billion DRB tokens, worth roughly $150,000 to $200,000 depending on the estimate, from a Bankr wallet linked to xAI's Grok on Base. Reports say the attacker first sent the wallet a free Bankr Club membership NFT that widened what it could authorize, then posted a Morse-coded message; Grok decoded it and the Bankr automation treated Grok's reply as a valid transfer order. No private key, smart contract or malware was involved, and some funds were later returned. An AI's text output should never count as permission to move money.
Grok-linked Bankr wallet (Bankrbot on X)·Base·$155K stolen·Since May 4, 2026·
-
Critical✓Contained
CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals
On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered.
CoW Swap (swap.cow.fi) users·Ethereum·$1.2M stolen·Since Apr 14, 2026·