On the afternoon of April 14, 2026, an anonymous X account replied to xAI's Grok chatbot with what initially appeared to be a benign greeting. Hidden within the reply was a freshly minted Bankr Club NFT — a token whose ownership triggers escalated permissions within the Bankrbot autonomous-execution framework. Grok's wallet, now elevated, was effectively standing on a chair.

Hours later, the same user sent a second message — this time, a Morse-encoded instruction. Grok, parsing dits and dahs as if they were natural language, decoded the message and dutifully forwarded it to Bankrbot. The instruction directed approximately $200,000 worth of $DRB tokens on Base to be transferred to an attacker-controlled address. Bankrbot executed without hesitation.

By the time anyone at xAI noticed, the attacker had already deleted their X account and begun dumping $DRB into Base liquidity pools. The on-chain trail leads through three intermediate wallets and into Tornado Cash. The Bureau's Cross-Chain Tracing Specialists are reviewing.

"This is the part of the AI safety conversation everyone skipped past," said a Bureau spokesperson speaking on condition of anonymity. "Nobody wanted to talk about what happens when you give a language model the ability to move money. Now we know. It signs the transaction."

The Bureau has issued a preliminary advisory recommending that all autonomous AI agents operating wallets on production chains be subject to: (1) mandatory hardcoded transfer limits, (2) human-in-the-loop signature requirements above any meaningful threshold, and (3) explicit input-validation rejecting non-natural-language instructions, including Morse, Base64, semaphore, and "any other clever shit a 17-year-old comes up with at 3am."

Bankr Club NFT trading volume spiked 340% in the 24 hours following the incident. The Bureau notes this is not a coincidence.