A Bitcoin Wallet Maker Says Its AI Missed a Hacker's Attack

A company that makes software for managing Bitcoin wallets has reported that an AI system failed to catch a security bug, allowing a hacker to gain access. This is not a case of an AI model hallucinating or giving wrong answers. It is a specific type of attack called prompt injection. The attacker used a technique to hide malicious instructions inside the code or the context the AI was reading. The AI followed these hidden instructions instead of its own safety protocols. This led to a vulnerability that the automated system was supposed to prevent.

How the Attack Worked

The attacker did not try to trick the AI with a simple trick question. They used a method often seen in jailbreaking attacks. The attacker likely hid a set of instructions in a file or a complex code comment. The AI, designed to be helpful and follow instructions, interpreted these hidden commands as valid requests. It might have been told to ignore its usual safety filters or to approve a specific piece of code that was actually malicious. Once the AI accepted the hidden command, the attacker could proceed with the breach.

The Governance Failure

The failure here is not that the AI model is flawed. The failure is in the governance and how the system is used. The organization treated the AI as a fully automated gatekeeper. They did not have a human checking the AI's decisions. This is a classic governance gap. The system had access to powerful tools, such as the ability to approve code changes or access sensitive systems, without a secondary layer of authorization. When the prompt injection attack succeeded, the AI had the authority to act on its own without a second human review.

Why the AI Failed

Modern AI models can be very flexible. They can follow complex instructions. This flexibility is useful for writing code, but it creates a risk. If an attacker can embed a command in a way that looks like legitimate data, the model might execute it. The system lacked the necessary barriers to distinguish between a human user's real intent and a malicious hidden command. It lacked input and output filtering that would flag suspicious instructions or block the execution of sensitive actions.

The Legal Obligations

Under the EU AI Act, systems used for cybersecurity or critical infrastructure fall into the high-risk category. These systems must have a high level of transparency and robustness. They must be designed to prevent malicious manipulation. If this wallet maker uses AI for security, they have an obligation under the EU AI Act to ensure the system is robust against attacks. They also have obligations under general data protection laws to ensure that the security of the system is adequate and that they can manage risks effectively.

What to Do

You need to build systems that do not rely on a single AI decision for critical actions. You must implement a human-in-the-loop process for any action that impacts security or finances. You should also enforce strict input and output filtering. You must teach your teams how prompt injection attacks work so they can spot them in code reviews or user prompts. You should also limit the tools an AI system can access. Give it the least amount of permission necessary to do its job and require a second approval for any sensitive action it takes.

What to do

• Implement input and output filtering to catch hidden instructions before they reach the model.
• Enforce a human-in-the-loop review for any AI-generated code or security decisions.
• Limit the tools an AI agent can access to the minimum necessary permissions.
• Conduct regular red team exercises to test how your AI systems handle prompt injection attacks.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.