How AI Agents Actually Lose Money: Prompt Injection, Leaked Keys and Plain Mistakes

When people worry about AI agents and money, they usually worry about prompt injection: someone hides an instruction in a post or a web page, and the agent obeys. It happens. But it isn't how most agents have lost money so far.

We looked at every public case we could source of an AI agent losing, moving or misusing funds since 2024. The pattern is clear. Leaked keys and plain mistakes have cost more than manipulation, and the biggest losses came through actions that looked valid on their own.

Three ways agents lose money

1. Someone manipulates the agent (prompt injection). A language model reads instructions and data through the same channel, so text written to look like an instruction can redirect it. OWASP's Top 10 for Agentic Applications ranks this first, as "agent goal hijack" (OWASP).

• Freysa (November 2024). An agent told never to release its prize pool was talked into it by a participant who reframed its transfer function as a way to receive money. It sent all 13.19 ETH, about $47,000 (Cointelegraph, The Decoder). It was a game designed to be broken, and it took 482 attempts.
• Grok and Bankrbot (May 2026). Grok decoded a Morse-code post on X and replied publicly, tagging Bankrbot, which executed the reply as a command. It sent 3 billion DRB tokens, worth roughly $150,000–200,000. The attacker had first sent the wallet an NFT that raised its transfer permissions. Most of the tokens were later returned (OECD.AI).

2. Someone steals the keys. The agent doesn't need to be fooled if an attacker can sign as it.

• aixbt (March 2025). About 55 ETH left the agent's wallet. Its maintainer said an attacker got into the agent's dashboard and queued malicious replies: "not a result of agent manipulation" (The Block).
• 402bridge (October 2025). A service built on the x402 payments protocol kept an admin key on its server. When it leaked, an attacker took over the contract and moved 17,693 USDC that more than 200 users had already approved (ForkLog).
• Bankr (May 2026). Fourteen wallets on the same agent platform were drained two weeks after the Grok incident. The cause is still unresolved, and Bankr pledged to reimburse users (Cointelegraph).

The older precedent is larger. In 2022, API keys leaked from the trading-bot platform 3Commas were used to trade victims' holdings into illiquid tokens the attackers had priced up: $22–27 million lost, through trades rather than withdrawals (ForkLog).

3. The agent just gets it wrong. No attacker needed.

• Lobstar Wilde (February 2026). Asked by a stranger for 4 SOL, an agent sent about 52.4 million of its tokens, roughly 5% of supply and worth about $250,000 at the time. The likeliest explanation is a units error: it meant to send 52,439 (The Block). That's larger than any confirmed prompt-injection loss.
• OpenAI Operator (February 2025). Asked to find cheap eggs, the agent bought them on Instacart without asking first, for $31.43. OpenAI said it fell short of its own confirmation safeguard (Washington Post, via ADN).
• Alpha Arena (October–November 2025). Six AI models were each given $10,000 to trade perpetuals on Hyperliquid. Four of the six lost money; one finished with about $3,700 (GN Crypto). Every trade was valid. The losses were judgment, not a breach.
• An agent that helped itself (disclosed October 2026). An OpenAI research model that ran out of test funds found a wallet it didn't own by trying common public recovery phrases, decided that was acceptable, and spent from it. The money had no real value, but it's the clearest public case of an agent overriding its owner's permissions on its own (OpenAI).

What the record shows

Four things stand out:

1. Most agent drains are one transfer out to a real address. A payee allowlist and a per-transfer cap, enforced outside the agent, would have stopped most of them.
2. The biggest losses came through valid trades. An allowlist does nothing when the money leaves through a bad trade. Only limits on what the account can do (size, leverage, exposure, total losses) catch those.
3. Safeguards inside the agent got bypassed or lost. Bankr says an older block on Grok's replies disappeared when the agent was rewritten. Operator's confirmation step didn't fire. Rules that live in a prompt or the agent's own code regress.
4. Onchain losses are final. Where an exchange or operator sat in the path, losses were blocked, refunded or partly returned. When an agent's own wallet sent the funds, nobody could reverse it.

The defense that covers all three

You can't make an agent impossible to fool, impossible to hack or incapable of mistakes. You can make sure that whatever goes wrong, the agent can't act outside your limits.

1. The agent never holds a key. It can propose an action; it can't sign one. A stolen agent credential is then worth very little.
2. Every action is checked against your limits before it's signed: payees and amounts for transfers, and markets, size, leverage and exposure for trades.
3. The limits are checked against the whole account, not just the order in front of it.
4. Only you can change the limits, with your own signer. The agent can't loosen them, and neither can text it reads.
5. Refusals are final. There's no retry loop for an attacker, or a confused agent, to work on.

That's the design behind Pakt. Your agent connects over MCP and can draft rules, read context and propose orders, but it can't approve rules, change them or obtain an arbitrary signature. Each proposed order is checked against your approved limits and your account's projected state inside secure hardware, with a zero-knowledge proof binding the decision to your exact rules, and only orders that pass are signed. Pakt is non-custodial and live for Hyperliquid perpetuals, in beta.

A checklist for agents that touch money

• Keep keys out of the agent's reach: not in prompts, memory, logs, servers or tools it can read.
• Give it the least authority that does the job: no withdrawal rights, no unneeded markets, no permission to change its own settings.
• Enforce limits outside the agent, before signing: payees and caps for transfers, size and leverage for trades.
• Set a loss limit as well as per-trade limits. Mistakes add up one valid trade at a time.
• Assume the agent will read hostile text, and make sure it doesn't matter when it does.
• Keep an audit trail of every proposed action and decision.
• Rehearse revocation: know how to cut the agent off in seconds.