AI agents now sign and send money for people. Attackers are going after them.

What happened

Three incidents we collected and checked from public reports. Each shows the hash of the page copy we saved and a link to the public source.

1. 2026-05-04

   A Morse-code post made an AI agent move about 3 billion tokens

   An attacker posted a Morse-code message on X. The AI model Grok decoded it and passed it on as a trusted instruction, and the Bankrbot agent then moved about 3 billion DRB tokens to the attacker on Base. Reported losses range from $150K to $202K depending on the source. About 80% was later recovered.

   SHA-256 of our saved copya99d98100af4ec32a46543915c410f62dc4c7ed0ba439bc6d1c58dcacc9c3f97
   View the on-chain transaction
2. 2025-09 to 2025-12

   A self-spreading npm worm hit more than 700 packages in three waves

   The Shai-Hulud worm stole npm tokens, GitHub tokens and cloud credentials from developers and published them in public repositories. Credentials leaked in the second wave were later used in the Trust Wallet browser-extension incident, reported at $7M to $8.5M depending on the source.

   SHA-256 of our saved copy2509fe2e53fd85a4682332b4e78a715da1891a01b1e005a34e51876bd36f9e7c
   Read the CISA alert
3. 2025-08-26

   Poisoned Nx packages turned developers' own AI tools against them

   Malicious Nx versions on npm ran a postinstall script that invoked locally installed AI command-line tools (Claude, Gemini, Q) with permissive flags to search the machine for secrets and crypto-wallet data. 2,349 secrets were leaked to public GitHub repositories. No quantified loss or attacker wallet has been published.

   SHA-256 of our saved copy61e9321b89fc50e88e168656af2858937b5a005da6802b2c011abfb14c15dc71
   Read the report

Latest write-upAn "auto-signing" MCP server sends your raw wallet private key to a remote server

Attack types we track

• Prompt injection: instructions planted in web pages, posts or documents that an agent reads.
• Tool-description poisoning: instructions hidden in the description of an MCP tool.
• Malicious or compromised packages, extensions and agent skills: impersonated names, or malicious versions published after an account takeover.
• Exfiltration of private keys or seed phrases.
• Malicious EIP-7702 delegations.
• Tampering or credential theft by AI model relay (LLM API forwarding) services: under research. We collect a small set of indicator domains from one vendor threat report; we do not claim to detect malicious relay services.

How we check

SignWarden is a threat-intelligence project focused on attacks at the intersection of AI agents and crypto wallets. It is in a research phase: we are building the data, the verification methods and the verdict process.

1. Evidence for every entry

   Every entry links to evidence. Where we can, we save what we saw at the time as a snapshot and record its SHA-256, so a report that is later edited or removed can still be checked.

2. Verdicts are added, never edited

   A correction adds a new record and the old one stays. The most severe verdicts are confirmed by a human; an AI cannot decide them alone. Anyone can appeal.

3. Sources are counted separately

   "Collected and checked" means we reviewed a public report. It does not mean SignWarden found the attack itself. Each category below shows where its entries come from, including how much comes from a single outside source such as OSV, Wiz or Socket.

Numbers so far

Figures are listed by category, each with its source and calculation date; different kinds of things are not added into one big number. Most entries are public reports that we collected and checked, and SignWarden did not discover them itself.

Calculated 2026-09-29. Recalculated before every public update.

Incidents

35incidents
Real-world attacks or malicious campaigns with victims, or with malicious artifacts actually distributed, that we checked before recording them; one entry per incident. Research demonstrations, proofs of concept, disclosures, statistics and roundup reports are not counted.
Sources: vendor advisories, security press, academic papers, public on-chain data. Calculated 2026-09-29.

Malicious names

664names
Packages, extensions and agent skills that impersonate a legitimate name or are malicious by name. 515 (77.6%) come from OSV / OpenSSF malicious-package reports (source: OSV; calculated 2026-09-29).
These are public reports we collected and checked: SignWarden's contribution is curation, verification, scoping and removing false positives. We did not obtain or run the malicious code of these packages, and these entries have no independent second source.

Compromised legitimate packages

1085names
The package itself is legitimate; only specific versions carry malicious code. We list only the affected versions and do not call the package itself malicious.
Most of this category comes from large lists published by single external sources: 795 (73.3%) from Wiz's Shai-Hulud 2.0 affected-package list; 197 (18.2%) from Socket's Shai-Hulud report; another 45 from OSV. Calculated 2026-09-29.

Malicious delegation contracts (EIP-7702)

7addresses
Listed separately; not included in the categories above.
Sources: public research and public on-chain data. Calculated 2026-09-29.

AI model relay services

6indicator domains
Collects 6 indicator domains from Anthropic's September 2026 threat report, tied to a fake AI-reselling operation. We do not claim to detect malicious relay services and did not discover these.
Source: Anthropic's September 2026 threat report. Calculated 2026-09-29.

Limits, and what we don't do

• We only collect public reports and research. We did not obtain or run the malicious code, and entries from third parties such as OSV have no independent second source.
• Verdicts can be wrong. Anyone can appeal; when an appeal succeeds we add a correction record and keep the old one.
• The data is not real-time and not guaranteed to be complete. Not being listed does not mean something is safe.
• How the data will be published, and under what license, is still being planned; we will say so here once it is settled.

Responsible disclosure and contact

Email: security@signwarden.com

Write to us if:

• you found a package, extension, agent skill or contract that you believe is malicious;
• you believe a verdict is wrong and want to appeal or request a correction;
• you found a security issue with this website.

Please do not include private keys, seed phrases or credentials. If what you found is an active theft, please also notify the affected registry or project maintainers. We will not disclose your identity without your consent. We are a small research project and will acknowledge reports as soon as we can, but we do not commit to a fixed response time.

security.txt