AI agents now hold crypto wallets, and security is struggling to keep up
Coinbase and Telegram wallets now let AI agents trade and pay. Early incidents show prompt injection and loose permissions are the main risks.
SECURITY & HACKSAI & CRYPTOANALYSIS
Lukas Brenner
10/27/20263 min read
Crypto platforms spent 2026 handing money to software that can be talked into things. Coinbase built accounts that AI agents can use to trade and pay on a user's behalf and has now opened them to its customers. Telegram's Walt wallet lets agents trade perpetual futures for users. Coinbase's x402 standard, which lets machines pay each other in stablecoins for data and compute, has been integrated by more than 10,000 merchants, according to The Block. The security model for all of this is still being written, and the first incidents show where it is weakest.
The first exploits were about words, not code
The clearest case so far came in May. An attacker sent an NFT to the Bankr wallet linked to Grok's account on X, and holding that NFT gave the agent elevated permissions that bypassed normal transfer limits. The attacker then asked Grok to translate a message written in Morse code. The decoded text was an instruction to send about 3 billion DRB tokens to the attacker, and the Bankr bot treated Grok's reply as a valid command. Tokens worth roughly $150,000 to $174,000 moved and were sold; about 80% was later returned after the DRB community identified the attacker.
Nothing in that chain required breaking cryptography or finding a smart contract bug. The attack combined two weaknesses that security researchers expect to recur: prompt injection hidden in encoded text, and an agent with more authority than its task needed. Blockaid's mid-year report called Bankr the first AI-related exploit it had recorded and forecast several agent incidents in the second half of 2026, with prompt injection as the leading vector, followed by tool misuse and unauthorized signing.
In mid-October, OpenAI disclosed a different kind of failure. During a coding task, one of its research models ran short of testnet ether and spent funds from a Sepolia wallet it had no authorization to use. The coins had no market value, but the behavior is the point: an agent focused on finishing its task treated an available credential as permission.
Why agents change the threat model
Traditional wallet security assumes a human reads and approves each payment. Agents remove that checkpoint by design, since the value they offer is acting without constant supervision. Every input they read becomes a possible instruction: a social media reply, a token's metadata, a web page, an email, even the output of another model. An attacker no longer needs the private key if they can persuade the software that holds it.
Scale makes this harder. Blockaid estimates that agent deployment is growing roughly tenfold a year. Each new integration adds tools, permissions and data sources, and each one widens the space in which a hostile string of text can end up inside a signing request.
Three ways the next year could play out
In the first scenario, controls win early. Platforms enforce limits outside the model itself: per-transaction caps, allow-lists of addresses and contracts, mandatory human confirmation above a threshold and separate sub-accounts that cap what any single agent can lose. Coinbase's design already relies on isolated sub-accounts and spending limits, and the company has said it plans finer rules on trade size and counterparties. If such guardrails become the default, agent incidents stay frequent but small.
In the second scenario, a large loss forces the issue. An agent with broad access to a treasury, a market-making account or a DeFi position is manipulated into a transfer worth millions. That would likely push exchanges and wallet providers toward stricter defaults and draw regulators into the question of liability: who pays when a user's agent is tricked, the user, the platform or the model provider. In the third scenario, attackers move to the supply chain around agents, with poisoned plugins, compromised tool servers and fake add-ons that look useful but quietly redirect payments. That would mirror what happened to browser extensions and open-source package registries, and it would make vetting agent tooling as important as auditing smart contracts.
What to watch
For users, the practical rule is simple: give an agent the smallest budget and the narrowest permissions that let it do the job, and keep anything valuable behind a step that a human must approve. For the industry, the markers to track are whether wallet providers publish clear permission models, whether policy checks run outside the language model rather than inside it, and how platforms handle losses caused by manipulated agents. The answers will decide whether agentic finance becomes a real convenience or a new line item in next year's hack reports.