AI agent wallets and prompt injection -- worth knowing before you connect one

[Mongoll]

Giving an AI agent write access to a wallet comes with a specific, already-exploited risk: prompt injection. A few documented cases:

- Freysa, an agent explicitly instructed never to release its vault, was talked into sending ~$47,316 in ETH after 482 adversarial prompts.
- Invariant Labs documented "tool poisoning" via MCP: instructions hidden in a tool's own metadata that the agent reads and obeys, invisible to the human operator.
- Princeton/Sentient researchers showed an ElizaOS-based agent's persistent memory can be poisoned by a single malicious interaction, corrupting every decision after -- not just one bad prompt.

Spend limits and account abstraction reduce blast radius, but they don't stop an agent from using its allowed actions against you.

Full breakdown + sources: https://cryptostrapon.com/stories/ai-agent-prompt-injection-wallet-drain

[Accardo]

My Toothaches trying to understand why an AI agent is given custody of $47,316, while its a research, social engineering is still a very valid means for hackers to permeate smart humans, what more an AI. Today I was on unchain podcast watching an interview of Gracy Chen, the Bitget Ceo, she attested to almost falling for multiple social engineering ploy that followed after the exchange got hacked. These people knew she needed help and claimed to be investors she's worked with in the past, she was smart enough to figure it out. Then think of how vulnerable an AI agent is to prompts built in the form of social engineering. However, this topic is suitable in the altcoin discussion session.

[BitMaxz]

Why trust your wallet with AI? Injections for wallets that hold keys are pretty common nowadays, not only from AI agents.
That's why there's no safe anymore online, and cold storage is still the best protecting your keys from online attacks.

To me, I won't fall to this to connect my wallet to an AI agent. Remember, they can also record or log anything from your wallet, which is not safe.
Always keep your wallet away from any 3rd party to connect to your wallet, just like in MetaMask, where most of the users are being hacked due to injection or exploit.

[shinratensei_]

Giving an AI agent write access to a wallet comes with a specific

I will stop at here, really? giving an AI agent permission to write access to a wallet? you're essentially handing out a control over your wallet to an agent that could hallucinates and heavily depending on context? if this is the normal practice then we're doomed. If you want to give your AI agent permission to write access you should limit the scope, approval based execution, or at least create different agentic wallet that don't have that much money to begin with. An AI agent with attention span of gold fish that could change its trajectory with a little interruption isn't going to keep your money intact.

[KiaKia]

Giving an AI agent write access to a wallet comes with a specific

I will stop at here, really? giving an AI agent permission to write access to a wallet? you're essentially handing out a control over your wallet to an agent that could hallucinates and heavily depending on context? if this is the normal practice then we're doomed. If you want to give your AI agent permission to write access you should limit the scope, approval based execution, or at least create different agentic wallet that don't have that much money to begin with. An AI agent with attention span of gold fish that could change its trajectory with a little interruption isn't going to keep your money intact.

It sound crazy but some people are actually doing this, it's not the first time that I will be hearing about it but most of the time it's through Metamask, the AI bot will have access to their Metamask wallet and do trades for them.

Through the swap feature of Metamask and also using Telegram bot, I've never done this before but I have heard about this many times in the past, I guess such crypto wallet must be empty most of the time.

It's like giving AI too much access and I don't like it either but I also don't expect someone to use such crypto wallet as their cold storage or where they store large amount of money.

[slaman29]

People trusting their lives with AI, listening to it to take medication and holiday trips, so no surprise people now trust it with wallets.

Remember when people trusted companies and exchanges to protect their funds? Remember when this forum was full of HYIPs?

[ABCbits]

It's crazy knowing how some people on this forum being cautious by using either hardware wallet, device only for crypto and even airgapped device only for crypto, while some other people connect their wallet with all website and AI agent.

Since this thread on Bitcoin Discussion board, does anyone have list of Bitcoin only or Bitcoin supported wallet that have feature connect to AI agent or random website? I expect most Bitcoin only wallet doesn't have such feature.

[matrixx]

My Toothaches trying to understand why an AI agent is given custody of $47,316, while its a research, social engineering is still a very valid means for hackers to permeate smart humans, what more an AI.

Accardo hit the nail on the head here. Handing hot wallet signing keys directly to an LLM completely breaks the fundamental rule of crypto security: deterministic execution. In standard programming, execution logic and untrusted user input are kept strictly separate. With language models, both share the exact same context window, which is why prompt injection isn't a simple software bug you can patch with a filter—it is an inherent architectural flaw of how transformer models interpret tokens.

The Freysa experiment basically proved that if you give people enough attempts, someone will eventually find the exact semantic loophole to convince the model that breaking its core directive is somehow "aligned" with its goals. It really is just automated social engineering against an algorithm designed to be agreeable.

If anyone wants to experiment with autonomous agents on-chain, giving them direct private key access is asking for trouble. The only setup that makes sense is hardcoded smart contract guardrails—whitelisted contract addresses, strict daily spend limits, and timelocks for larger withdrawals. Relying on an English system prompt like "never release the vault" as your cryptographic barrier was bound to fail.

[Lucius]

~snip~
Since this thread on Bitcoin Discussion board, does anyone have list of Bitcoin only or Bitcoin supported wallet that have feature connect to AI agent or random website? I expect most Bitcoin only wallet doesn't have such feature.

I don't know of any such wallet, though I have no doubt they exist, given that there is practically no product or service anymore where AI isn't present in some way. I recently read an article where children's toy manufacturers are starting to sell stuffed toys that talk with the help of AI. Obviously, the ultimate goal is to create new generations that will be completely dependent on AI - although many people are already completely dependent on artificial intelligence in their everyday lives.

[crwth]

There's such a thing as this? I don't know why you would let it use it unless it's some kind of tool to trade with DEX's or something.

I mean, of course, you don't need to send or give access to the private key, right? Could you use multi-sig wallets or some kind of smart contract for this?

The question that should be answered is "Does the AI hold the private key?"

[Taskford]

There's such a thing as this? I don't know why you would let it use it unless it's some kind of tool to trade with DEX's or something.

I mean, of course, you don't need to send or give access to the private key, right? Could you use multi-sig wallets or some kind of smart contract for this?

The question that should be answered is "Does the AI hold the private key?"

That's actually the question, but imagine how crazy those people decide to give their private keys to Ai. Knowing that its risky to do such thing. Maybe they could find convenience doing this, but imagine the risk if they experience prompt injection.

Usually what I know is there are people give permission to sign some transactions, also to automate their activities. By this the Ai have capabilities to move some funds base on the commands they are written.

But I really don't like doing such thing, because we are talking about safety of our funds here. I'd rather deal everything on my wallet manually.

[cryptomaniac_xxx]

Giving an AI agent write access to a wallet comes with a specific

I will stop at here, really? giving an AI agent permission to write access to a wallet? you're essentially handing out a control over your wallet to an agent that could hallucinates and heavily depending on context? if this is the normal practice then we're doomed. If you want to give your AI agent permission to write access you should limit the scope, approval based execution, or at least create different agentic wallet that don't have that much money to begin with. An AI agent with attention span of gold fish that could change its trajectory with a little interruption isn't going to keep your money intact.

As far as I know, you will be given prompt by AI if you really wanted to do this, or some sort of given them permission as this is really very dangerous move if you are creating AI agent. So in a sense it's your fault as you let AI takes over your account.

And we all know that if you do that, it can't be control as there could be a lot of interjections like in this example. I know that people right now are heavily relying in AI, but we should set the boundaries.

[coinlary]

So many people are making use of AI wrongly  tbh. This thing is meant to make work easier not entirely think and work on our  behalf without any input from us.

I can't  believe we are already lazy to the extent of letting AI handle our financial stuffs . I only wonder what will eventually happen when they make us overly dependent and have to eventually subscribe for basic things because we don't understand how to do them anymore.

The future isn't really looking good 

[ryzaadit]

There's such a thing as this? I don't know why you would let it use it unless it's some kind of tool to trade with DEX's or something.

Due to the use case of AI, some exchanges or wallets try to integrate AI Agents with their service. Many of them can share you for example:
[1] Metamask: https://metamask.io/agent-wallet
[2] Coinbase: https://id.tradingview.com/news/coinpedia:1d2e9d202094b:0-tether-co-founder-ai-agents-will-transform-stablecoins-and-crypto-wallets/
And many more.

The question that should be answered is "Does the AI hold the private key?"

No, not giving any private key.

AI agent crypto wallets use specialized frameworks to let agents securely transact without ever seeing or touching your actual master keys.

I been talking about these, especially with exploited AI prompts. There is another prompt injection that everyone should be aware of; it's called Generative Engine Optimization (GEO). Once a scammer can master these, GEO can beat any scam from Ads/SEO. The reason, each time we search the internet our browser automatically turns on the AI integration setting. Same things about search information with AI, but also everyone should know each answer from AI could be wrong, outdated, missleading these is why you should check the answer as well (to avoide the answer being injected by scammer).
More: https://github.com/OffcierCia/Generative-Engine-Optimization

Bitcoin Discussion board, does anyone have list of Bitcoin only or Bitcoin supported wallet that have feature connect to AI agent or random website? I expect most Bitcoin only wallet doesn't have such feature.

Some multi-currency wallets (including Bitcoin) can get these features for AI agents. Found a few:

• Xverse: https://www.xverse.app/agents
• Trust Wallet: https://trustwallet.com/blog/company/introducing-the-trust-wallet-agent-kit-twak-your-ai-agent-can-now-act-on-crypto
• Moonpay: https://support.moonpay.com/en/articles/586583-moonpay-cli-for-ai-agents

[nelson4lov]

Idk, but anybody who knowingly connects their main wallet to an AI agent deserves to get drained, especially in this year and age. It's not as if that's the first time that we have seen AI agents being exploited to give up whatever funds they have under their control. The best practice with these agent is just to give it it's own wallet to contribute. Separation of concerns works well for this.

[Sandra_hakeem]

Why trust your wallet with AI? Injections for wallets that hold keys are pretty common nowadays, not only from AI agents.
That's why there's no safe anymore online, and cold storage is still the best protecting your keys from online attacks.

This post made me believe that at least 60% of what's supposed to be  "sudden attack/hacks" are really not sudden.

We all know the dangers of entrusting your private keys on another human, let alone an AI? It's just stupid to have your coins in a wallet injected by AI prompts and not feel disturbed one bit, that's not normal. What's the level of trust? They always have so much to buy and hold, but not an atom of effort to protect it. I think people have taken AIs too seriously that they subconsciously create a reality that doesn't exist for those bots--- like having them run an undetachable maintenance and safety on a wallet that holds millions in crypto.

Since this thread on Bitcoin Discussion board, does anyone have list of Bitcoin only or Bitcoin supported wallet that have feature connect to AI agent or random website? I expect most Bitcoin only wallet doesn't have such feature.

Most Bitcoin-supported native wallets have Ai features now. I think Bitcoin.com wallet has an updated AI feature and also connects to other websites.

[AVE5]

Why trust your wallet with AI? Injections for wallets that hold keys are pretty common nowadays, not only from AI agents.
That's why there's no safe anymore online, and cold storage is still the best protecting your keys from online attacks.

If not for the very advantage of the cold wallets storing their seed phrase offline which makes it extremely difficult for hacker's to invade the wallet.
For goodness sake what's the AI doing in a wallet? It's not even like it's a trading tool that user's intentionally entrusts on predicting bitcoin price which still isn't reliable.
So I'm just thinking how an experience users would trust wallets designated to be regulated by the AI.
Unfortunately if you think the tool as a program is not reliable than the Cex as to say, then it's a big mistake.
Off line storage that gives you access to self custody always serves best.

[BitMaxz]

If not for the very advantage of the cold wallets storing their seed phrase offline which makes it extremely difficult for hacker's to invade the wallet.
For goodness sake what's the AI doing in a wallet?

There was a viral issue before about generating seeds. Before, the wallet used 3rd parties to predict text or spell-check; one of them is the Coinomi wallet, meaning if AI is injected into our wallet, the chances of our keys being leaked are very high.
What they are doing is they can log your keystrokes and record your transaction histories, like the 3rd party predict text and spell check. I am sure AI also had them and any other threats.
So if you are using a wallet with AI, better avoid it at all costs because it's no longer safe, or if ever you are infected, that injects AI, take action immediately by sending your funds to a newly created wallet.

Many people leak their seed phrase due to predicted text and spell check that works just like AI.

[shinratensei_]

There's such a thing as this? I don't know why you would let it use it unless it's some kind of tool to trade with DEX's or something.

I mean, of course, you don't need to send or give access to the private key, right? Could you use multi-sig wallets or some kind of smart contract for this?

The question that should be answered is "Does the AI hold the private key?"

It doesn't even need to know private key if the framework allow write/read access, it's essentially the same as holding private key due to permission, as far as I know supplying private key to agent is bad practice because the prompt is getting uploaded to server where it's getting logged by the data center in which AI inference takes place. Even if the inference provider said they are ZDR (zero data retention) you can never trust the stranger.

Since this thread on Bitcoin Discussion board, does anyone have list of Bitcoin only or Bitcoin supported wallet that have feature connect to AI agent or random website? I expect most Bitcoin only wallet doesn't have such feature.

Xverse is the one I knew that works with most AI harness such as Hermes, OpenClaw, it even works with CLI based AI harness like claude code and it's approval based when it comes to Bitcoin transaction.

[Darker45]

I've read about Freysa. This was an experiment years ago. It's obvious AI doesn't have an ability to discern. AIs are mathematical, black and white, creatures. It's a double-edged sword. It's rigid, so it can't be tricked in a human sense. I mean, no amount of cunning approaches could make it change its decision, but the same rigidity makes it open for shortcomings and points of attack.

But I think AIs are getting more and more intelligent by the minute. Freysa would look like a Neanderthal after just a yearlong progress.