News27 July, 20263 min read

Bankr co-founder suspects "a critical security vulnerability" at X or "an inside job"

The co-founder of Bankr, an AI bot that turns social posts into crypto trades, is telling users to add a separate security check after attackers controlled its X account.

Discuss this article:

Does this story need context? Notes are selected by independent community ratings, not editors.

How it works

Bankr was built to make trading crypto on X feel as easy as sending a reply. But on Saturday, July 25, that same setup turned against it when hackers seized the official Bankrbot X account and began advertising a fake airdrop, a bogus giveaway promising users free tokens.

Bankr warned people not to open the links. By then, however, its team had been locked out, while whoever controlled the account could continue posting.

Bankr primarily runs on Base, Coinbase's low-cost Ethereum network.
A user sends Bankr a plain-English order, while Privy, a crypto wallet, creates a background wallet tied to that user's social login and allows Bankr to launch a token on the user's behalf.
The X account effectively serves as the front door to the service.

Bankr said the hackers hadn't breached its trading systems or wallet software. It still urged customers to add multi-factor authentication directly to their Bankr accounts.

The hackers could post. Bankr could not

Deployer, Bankr's pseudonymous co-founder, said in a Sunday post on X, July 26, that Bankr's official X account had a "passkey on the account," calling it "arguably one of the most secure 2FA mechanisms."

Still, the account was taken over, prompting Deployer to speculate that it involved either "a critical security vulnerability in X backend systems that they haven't found" or "an inside job."

"The attackers were still able to sign into the account to push malicious links -- the latest being long after we were already locked out of the account. Why was it that the attackers had full access to log in and post, but we were blocked by this screen? Why weren't the attackers blocked?"

Deployer

The takeover may have extended beyond fake posts. Data from SlowMist, a blockchain intel firm, shows that a wallet it described as Bankr's lacked a separate multi-factor authentication and lost about 1.5 billion BNKR, Bankr's own token, worth nearly $480,000. SlowMist said the tokens "were then dumped."

Bankr hasn't confirmed the loss. It has also released no estimate of how many users, if any, lost money after opening the fake airdrop links.

Base