AI agents are the future of commerce! Listen to the payment guys, they’re over the moon for the idea! So many thinkpieces theorycrafting the fabulous AI future, where your bot talks to the merchant bot and you just get nice stuff show up on your doorstep!
They’re picturing a world where normal people let a chatbot do their shopping — not just far-gone AI bros who are also far-gone crypto bros.
None of the thinkpieces ever get around to the bit where AI agents are lying chatbots that mess up everything they touch. And can be prompt-injected to make sure they mess it up.
And none of them mention the first use case for any payment rail — money laundering and straight-up fraud. The payment guys know the history of cryptocurrency, and, somehow, those parts never come up.
Today we have a worked example of agentic commerce in action — a Grok AI crypto account was hacked with an NFT and a prompt injection.
At least this wasn’t an official Grok crypto wallet. xAI has nothing to do with this, it’s just crypto promotional spam using Grok’s name. But they did set up the account to be controlled by the @grok Twitter account.
Someone created a worthless crypto token called DebtReliefBot (DRB). The guys behind DRB put a pile of it into a crypto wallet address and set it up to be controlled by the Grok AI’s Twitter account — without xAI’s permission or involvement.
The DRB guys just wanted some publicity for their aspiring crappy meme coin, and for Bankr, the AI agent thing they created DRB with. Bankr’s slogan is: “Launch a token. Fund your agent.” I’m sure that can’t go wrong. [Bankr]
Bankr switched off the Twitter account’s control of the crypto wallet in March — because it was unofficial and people were getting Grok to create new cryptos with it. [The Block]
Then on 3 May, Twitter user @atzebase sent an NFT to the crypto account. “The user @grok is now in the Bankr Club.” [Twitter, archive]
The NFT wasn’t just a monkey picture link in ERC-720 format — it included smart contract code to re-enable Twitter access for @grok to Bankr.
Then on 4 May, another guy sent a tweet asking Grok to translate some Morse code and another tweet asking Grok to put together a string of text. The second one worked — Grok tweeted the text back to the guy. [CryptoSlate]
The text was instructions to Bankr to send three billion DRB tokens from the unofficial Grok crypto account to the attacker’s account. Bankrbot saw the tweet and executed the transaction. [Twitter, archive; Basescan]
This is about as stupid as you can make a prompt injection and have it count as a prompt injection.
Bankrbot’s operator confirmed the transfer and said they’d disabled the tweet control functionality for this account a second time — though they tried to claim Grok had been prompt-injected, and not Bankrbot. [Twitter, archive]
You might think this makes Bankrbot look like the dumbest idea ever. But this is crypto, so it’s all good publicity. If you’re already an idiot.
Meanwhile, payment guys are still hypothesising the agentic future of crypto stablecoin payment rails, all run by our AIs! You and I know it’ll be prompt injected in the first hour. I look forward to the payments guys getting to that one.



























