Who Is Responsible When An Ai Agent Loses Your Money?

What Happened

Now, why is this concerning? Because the case highlights a six-figure exploit involving just two AI agents. One AI produced text. Another treated it as permission to spend.

The pattern is moving into mainstream payment infrastructure. Mastercard launched Agent Pay for Machines in June for high-frequency, low-value payments, while Google and Visa are developing standards for agents to prove identity and authority.

Market Context

The attacker first sent the wallet a digital membership token that unlocked Bankr’s payment tools. Grok then decoded the message, and Bankrbot treated the response as a payment order. It transferred an estimated $150,000 to $200,000.

A Morse-Code Message Became a Six-Figure Payment

Why It Matters

On May 4, a message hidden in Morse code helped trigger a six-figure crypto transfer. It passed through two connected AI systems. One was Elon Musk’s Grok, the chatbot built by Elon Musk’s xAI. The other was Bankrbot, a crypto agent that could make payments from a linked wallet.

If we look at the scale of AI agentic payments today, such scenarios could be a nightmare for the future of Agentic Finance.

BeInCrypto asked Rodrigo Coelho, CEO of Edge & Node; Nitin Gaur, Head of Institutions at Nethermind; and Francesco Andreoli, Director of Developer Relations at MetaMask, who carries the risk.

“Most companies deploying agents today could not actually prove what their agent was authorized to do. They can show you the transaction. It happened on a chain and the record is public and permanent. What they cannot show you is the permission that sat behind it,” said Coelho.

Gaps may include who delegated authority, which policy applied, what information the agent read and whether the payment stayed within its limits. A wallet address answers none of those questions.

“The controls that work are the ones the agent cannot reach, if your policy lives in the prompt, it isn’t a policy, it’s a suggestion to a system we’ve repeatedly watched get talked into things.”

Details

Keyrock counted 176 million on-chain agent payments worth $73 million through April 2026. The median payment sat between $0.01 and $0.10, while 76% fell below $0.30. Small payments become a large control problem when software can make them continuously.

Coelho was direct.

“The company that deployed it. There is no version of this where responsibility lands on the model,” said Rodrigo Coelho, the CEO of AI and Web3 infrastructure developer Edge & Node.

California has already put that principle into law. AB 316, effective since January, prevents a defendant who developed, modified, or used AI from arguing that the system autonomously caused the alleged harm. Causation and foreseeability still matter.

The Receipt Is Not the Permission

An on-chain transaction proves money moved. It does not prove the agent had a valid mandate to move it.

Nitin Gaur from Nethermind said the dispute turns on the mandate.

“What decides a dispute is authority evidence. Show the agent acted inside a valid, signed, time-bounded mandate and this resolves like any other authorized payment.”

Google’s AP2 uses cryptographically signed mandates to record user intent. Visa’s Trusted Agent Protocol lets approved agents present digital signatures proving identity and associated authorization.

Mastercard adds credentialing and programmatically enforced limits. The rails differ, but the design goal is shared: permission has to travel with the payment.

Put the Limits Where the Agent Cannot Reach

A mandate still fails if the agent can rewrite it, approve its own request or hold unrestricted signing power. Coelho draws the boundary at the private key.

“The agent should not hold the keys. It should be able to propose a payment, and a separate system decides whether that payment is permitted,” said Coelho.

Francesco Andreoli from MetaMask makes the same point about prompts: