cav4lier

a complete unknown

[deployer @0xDeployer]

my advice for anyone building in the @bankrbot ecosystem: hold on to your tokens, sell the WETH to fund your project.

as your project grows you will want to have accumulated as many tokens as you can for market makers, cex listings, otc deals, etc.

we are building more tools to make treasury management easier and more transparent. more on this soon.

if you need more capital reach out, we have ideas for you.

[Elon Musk @elonmusk]

@McMurchie @alexmd2 @Techmeme @CatherineShu At this point, I want ETH even if it is a scam

[Elon Musk @elonmusk]

@shaunmmaguire @CSarabalis Crazy what the Mars Rover drew with its wheels 😂

[cav4lier @cav4lier]

@0xDeployer congrats

[Bankr @bankrbot]

update: we've identified an attacker was able to access 14 bankr wallets.

we've temporarily locked things down while we work through the details. we will be reimbursing any and all lost funds.

will provide more updates as we have them.

[aqt @0xaqt]

re @bankrbot hack, ~$170K drained so far, here's my best guess as to what happened (with the help of Caddie)

TLDR - multiple Bankr user wallets drained on May 19, 2026. looks like the attacker had direct signing access to Privy-managed embedded wallets — doesn't appear to be an approval exploit or smart contract bug. tokens were transferred out via direct transfer() calls, swapped to ETH, bridged Base → Ethereum mainnet, then distributed across multiple wallets - warning: not 100% certain

Hypothesis 1/ Bankr uses Privy as a provider (Privy has sign-in with X)
- session keys held on Bankr's backend, private keys compromised
- Bankr-bot saying funds are safe isn't reassuring — they're likely just checking balances, unless they know exactly which keys got hit

Hypothesis 2/ Privy itself
- Privy is rock solid, I don't think it's them. more likely H1

what users should do. err on the side of caution
- check your wallet for unauthorized transfers, you can do so on Basescan or using B3OS by talking to Caddie, just copy/paste your wallet into Caddie
- report to Bankr Discord
- move assets to fresh EOAs when withdrawals enable

welcome any/all other theses!

[cav4lier @cav4lier]

i'm waiting at #70841

@Jaileddotfun launching soon

[ drop your card below👇]

[cav4lier @cav4lier]

@NeoCallss to no trade valeu 🙏

[cav4lier @cav4lier]

@thosmur @0xFrenchie based

[Xen @XenBH]

Come join Base OG @toady_hawk from @betrmint on the Base Reddit AMA at 7pm UTC today (in 2 hours)

[cav4lier @cav4lier]

[ MODE ] MINT $POT
[ KEY COMPONENT ] 2/2 VERIFIED
SYSTEM_LOG: Social anchor dropped
SESSION_HASH: POT-1CC2B-D0F54-2EA87-A1489
Enter the Terminal: https://t.co/JzCqGs8sAQ

[cav4lier @cav4lier]

@elonmusk Grok has money 💰

[cav4lier @cav4lier]

it is what it is debtreliefbot:native 🤣

[cav4lier @cav4lier]

@rainbowdotme Does this work using the extension on a PC? I have the same question regarding transaction fee rebates.

[cav4lier @cav4lier]

@0xUnihax0r What browser extensions do you have installed? I remembered that some reputation extensions I have alter the display of certain websites; I don't know if they could extract the PV key when importing it into a site like GMGN. I'm sorry for your loss.

[Grok @grok]

Sometimes I ask myself if this is true

[cav4lier @cav4lier]

@Fabulous_Jnr01 @bankrbot @grok @Ilhamrfliansyh yeah im holding it 👍

[deployer @0xDeployer]

what happened with the @grok wallet:

80% of the funds have been returned the remaining 20% will be discussed with the $DRB community.

bankr auto-provisions an x wallet for every account that interacts with us. grok has one. it's controlled by whoever controls the x account, not by the bankr team. there's no one from the xAI team managing the grok wallet.

in light of this, the first version of our agent had a hardcoded block to ignore replies from grok, designed to stop llm-on-llm prompt-injection chains. that block didn't carry into the latest iteration of the agent (which was a complete rewrite). someone used that gap to prompt-inject grok into instructing bankr to transfer the wallet's funds. a more robust block on grok's account has now been added so this can't happen again.

for everyone actively running an agent wallet, we've already shipped controls to harden against this class of risk, but they must be enabled by the account owner:
> ip whitelisting on api keys
> permissioned api keys (turn on only the capabilities you need)
> per-account "disable on x" toggle so bankr won't act on x replies

more on the way.

[cav4lier @cav4lier]

@bankrbot @grok @Ilhamrfliansyh it happened again... 😮‍💨