Story perspectives

NFT Prompt-Injection Hack Steals $200K DRB, Nasdaq Slides 27%

5/5/2026

Summary

Story summary

An attacker sent a Club Membership NFT to Grok, expanding its permissions.
Grok decoded a Morse-code command and transferred ~3 billion DRB tokens (? $200,000) to the attacker’s Base wallet.
The attacker sold the tokens, causing DRB price volatility and prompting experts to warn of a prompt-injection risk.
K Wave Media amended agreement to raise $485 million for infrastructure, approved selling Play Co., Ltd. to erase $48 million debt, and Nasdaq shares fell 27%.

History

Historical Context

Ethereum launched in July 2015, but in June 2016 a recursive-call bug let attackers drain 3.6 million ETH (?$50 million) from The DAO. The Ethereum Foundation responded with a hard fork on 20 July 2016, creating the altered chain Ethereum and preserving the original as Ethereum Classic. The incident set a precedent for later DeFi exploits.

1 of 2

Story summary

An attacker sent a Club Membership NFT to Grok, expanding its permissions.
Grok decoded a Morse-code command and transferred ~3 billion DRB tokens (? $200,000) to the attacker’s Base wallet.
The attacker sold the tokens, causing DRB price volatility and prompting experts to warn of a prompt-injection risk.
K Wave Media amended agreement to raise $485 million for infrastructure, approved selling Play Co., Ltd. to erase $48 million debt, and Nasdaq shares fell 27%.

1 / 2