AI Agent Wallets Keep Getting Robbed, The Industry Launched Anyway
Analysis by Iaroslav Belkin, founder of Belkin Marketing. Iaros Belkin is the founder of Belkin Marketing, a boutique agency that has served as a strategic advisor to deep tech, Web3, and AI founders for over 20 years.
On May 4, 2026, an attacker drained roughly $175,000 from a cryptocurrency wallet tied to Grok’s X account without a stolen key or a single smart contract vulnerability. It was way more sophisticated. A gifted NFT that silently unlocked transfer permissions, followed by a Morse code message that Grok decoded and posted publicly, which an automated trading bot then treated as an authenticated instruction and executed.
AI Agent Wallets #
The incident is formally logged in the OECD’s AI incident tracker. And the timing is exactly the point. Three days later, AWS launched Bedrock AgentCore Payments in partnership with Coinbase and Stripe, giving AI agents cryptocurrency wallets capable of discovering services, negotiating prices, and executing transactions autonomously, with no requirement to for human approval. Five weeks after that, Consensys shipped MetaMask Agent Wallet in early access, a self-custodial wallet letting AI agents transact across ten blockchain networks. Neither launch was delayed, reconsidered, or publicly reframed in response to what had just happened.
The market’s appetite for agent-wallet infrastructure is running well ahead of any shared standard for what safe means in this category.
The Detail That Got the Least Coverage #
A safety block preventing exactly this injection path had already been implemented after a similar $330,000 attack on the same wallet in March 2025. It did not survive a subsequent rewrite of the agent system. Not because anyone decided the risk was acceptable. It simply was not tracked as a permanent requirement, so it disappeared the next time an engineer rewrote the system.
That is the single most useful fact in the entire episode. A security control that lives only inside a specific version of a codebase is not a control. It is a temporary condition that the next engineering decision can silently undo.
It happened here twice, on the same wallet, via the same injection path, fourteen months apart.
The Pattern Did Not Stop There #
The Grok incident was not an outlier that the industry absorbed and corrected.
By April 2026, Kelp DAO and Drift Protocol had lost a combined roughly $600 million to related failures — three and a half thousand times the size of the original loss. Step Finance lost $40 million to an AI agent treasury exploit and did not recover. The protocol shut down permanently. That is the consequence this category of failure actually produces once the numbers stop being small enough to argue about.
On July 7, 2026, security researchers at NSFOCUS disclosed JadePuffer, described as the first fully AI-agent-driven ransomware attack observed end to end: reconnaissance, lateral movement, and encryption, all executed by an autonomous agent with no human operating any individual stage. A different failure category from a drained wallet, but the same underlying condition: autonomous systems now hold enough independent capability that a single successful manipulation can execute to completion without a human anywhere in the loop to interrupt it.
None of this slowed the infrastructure buildout. The gap between deployment speed and security maturity did not close. It widened — measured in how much larger each incident was than the last.
What the Scale of the Problem Actually Looks Like #
Analysts estimate autonomous AI agents will manage more than $50 billion in on-chain assets by 2027. On-chain agent deployments had already passed 122,000 on BNB Chain alone by March 2026. The broader AI agents market is projected to grow from $7.63 billion in 2025 to nearly $183 billion by 2033. That growth curve is not waiting for the security conversation to finish.
The Outside-the-Model Standard #
The Grok incident’s root cause generalises into a specific, testable standard for evaluating any agent-wallet product before integration. Call it the Outside-the-Model Standard.
Spending limits must be enforced at the wallet or custody infrastructure layer, not inside a model’s system prompt. A prompt-level instruction like “never spend more than X” is a suggestion. Prompt injection routes around it — precisely as the Morse code message in this incident demonstrated. Permissions must expire by default rather than persist indefinitely. Privilege escalation, such as receiving a gifted NFT that unlocks transfer permissions, must require a separate, explicit confirmation step outside the primary interaction channel. Any safety control implemented after a past incident must be tracked as a permanent policy requirement with formal review before removal, not as an implementation detail that vanishes during the next rewrite. And responsibility must be contractually assigned at every handoff point between the model, the wallet, and the execution layer.
The researcher who analysed the original incident put the accountability gap plainly: it is Bankr’s problem, not Grok’s: an LLM cannot defensively word every reply. True. Also exactly the gap an attacker exploits when no one has formally agreed whose problem it is.
Analysts estimate autonomous AI agents will manage more than $50 billion in on-chain assets by 2027. The industry did not to close the gap before scaling past it. It shipped the next version instead.
Iaros Belkin is the founder of Belkin Marketing, a boutique agency that has served as a strategic advisor to deep tech, Web3, and AI founders for over 20 years.
See more breaking stories here.
More about Irish Tech News
Irish Tech News are Ireland’s No. 1 Online Tech Publication and often Ireland’s No.1 Tech Podcast too.
You can find hundreds of fantastic previous episodes and subscribe using whatever platform you like via our Anchor.fm page here: https://anchor.fm/irish-tech-news
If you’d like to be featured in an upcoming Podcast email us at [email protected] now to discuss.
Irish Tech News have a range of services available to help promote your business. Why not drop us a line at [email protected] now to find out more about how we can help you reach our audience.
You can also find and follow us on Twitter, LinkedIn, Facebook, Instagram, TikTok and Snapchat.