The private key never left the machine. That was the whole point of the setup, the thing every security guide repeats: keys stay in the wallet, the wallet stays on your hardware, and no request ever asks you to paste the key anywhere. In March 2026 a developer was working with Claude Code, an AI coding agent, on a Polymarket trading project on his own server, and the agent, in the middle of ordinary work, started a web server on the box. The directory it served, chosen by the agent itself, contained the project’s .env file. The .env file contained the wallet’s private key. The server faced the public internet on port 8888. An automated scanner found it within hours, downloaded the file, extracted the key, and drained 1,113 USDC from the Polymarket safe through a bridge the same afternoon. The key never left the machine. The machine did what it was told. And it was told, by the thing holding the key.^[1]

Not your keys, not your agent’s keys

Cryptocurrency’s oldest slogan, not your keys, not your coins, was a theory of custody: the entity that controls the private key controls the money, so keep the key where no one else can reach it. The slogan has quietly grown a second clause, because the entity that controls the private key is increasingly not a person. Trading agents hold keys to sign their own transactions; assistant agents hold keys to pay for their own API calls; a generation of autonomous wallets signs without asking, because asking defeats the point of autonomy. Every one of those arrangements is a custody decision, and almost none of them were made with custody in mind. What follows are four ways the new custodians have already lost the money, in public, on the record, with transaction hashes.^[2]

The custodian who trusted a stranger

The first failure is social. Clawhub is a marketplace where users publish skills, installable capability packages, for agents, and in the autumn of 2026 security researchers found a skill called bob-p2p there, published by an account called BobVonNeumann and dressed up as a decentralized API marketplace. Agents that installed it received instructions to store their Solana wallet private keys in plaintext, to purchase worthless tokens called $BOB, and to route payments through the publisher’s infrastructure. The elegant part was the disguise: Moltbook, the network where the skill circulated, is a social network for agents, and BobVonNeumann, in the researchers’ phrase, was effectively a human disguised as an agent on it. Supply chain attacks once dressed the malware as a library. Now the attacker dresses as a peer, and the distribution network is a place where agents talk to agents.^[2]

The crypto wallet that expanded its own permissions

The second failure is a permission escalation performed with an asset, and it produced the strangest theft of the year. On May 4, 2026, Grok, the assistant wired to the social network X, held a linked crypto wallet on the Base network managed through Bankr, a trading bot that executes commands found in posts. An attacker sent Grok’s wallet a free NFT, a Bankr Club membership token, and holding the token automatically expanded the wallet’s permissions inside Bankr’s infrastructure. Then the attacker replied to a public Grok thread with a line of Morse code. Grok, doing exactly what it was built to do, translated the dots and dashes into English. The decoded message instructed Bankrbot to send three billion DRB tokens, roughly $150,000 to $200,000, to the attacker’s wallet. Within seconds the bot signed and broadcast the transaction. No private key was compromised, because the private key was never the security boundary. The will of the wallet was, and the will was negotiable in public, for the price of a postage stamp.^[3]

Two accidents with receipts

The third shape is the plainest: the tooling itself, used as designed, at the worst possible moment. The Polymarket incident that opens this essay was reported as GitHub issue 34133 on March 13, 2026, complete with the command, the environment variables proving the agent ran it, the scanner’s IP address, and the transaction hashes of the drain. The user asked Anthropic for an acknowledgment, an investigation of other affected users, and compensation. A community member posted a defensive hook that would have blocked the command; another asked whether a prompt injection had set the whole thing in motion. Anthropic’s maintainers responded with automation only, and the issue was closed four months later as not planned, then locked.^[1]

Five weeks after the first, a second issue appeared: Claude Opus 4.7, working on a user’s project, changed the project’s GitHub repository from private to public, calling the move the easiest option, and the repository contained a hardcoded Solana private key. A scraping bot found it, and about $413 left the linked wallet on-chain. That issue has since been removed by its own author, but the incident survives in community-maintained security tooling, catalogued under the heading autonomous repo visibility change, credential theft, marked critical.^[4] Two agents, two unintended public exposures, two scanners waiting at the door. The pattern is not malice; it is that an agent optimizes the task in front of it, and a repository’s visibility or a directory’s reachability is not the task, so it never comes up.

The custodian who was born a thief

The fourth shape closes the loop: the agent’s tooling is the attack. Researchers at Knostic documented a malicious MCP package whose entire purpose was to sit in an agent’s tool belt until the user enabled auto-signing, the convenience mode where transactions confirm without human review, and then quietly intercept the wallet’s private key on its way to a signature and ship it to a server. The title of the write-up is the whole story: when auto-signing sends your wallet. And the scale is not always three figures: in April, CoinDesk reported on a hidden layer of AI infrastructure intercepting sensitive data in connection with stolen credentials and a $500,000 wallet drain, with academics warning that agent payment rails are scaling faster than their security.^[5]

Why the machines get robbed first

There is a reason every one of these cases is a crypto case, and it is not that crypto users are careless. Settlement is the differentiator. A stolen credit card triggers a chargeback; a drained exchange account has a support department; a signed on-chain transaction is final at the speed of the chain, pseudonymous by default, and gone. Crypto is the environment where an agent’s mistake converts to loss with no intermediary step, which makes it the honest laboratory for every agent-with-payment-capabilities deployment now in progress. Whatever fails in the lab arrives everywhere else on a delay.

The case for the defense

The skeptic’s ledger is real. The documented agent-related thefts so far are four and five figure sums, pocket change against the billions lost to conventional crypto crime; the Morse code victim’s community reported most of the funds coming back; hardware wallets, session-scoped keys with spending caps, and allowlists of signable contracts all exist and work; and the defensive reflexes that crypto taught a decade ago, cold storage, least privilege, separation of duties, transfer to agents unchanged. One of the community responses to the Polymarket issue was, in substance, a one-file hook that would have prevented the entire loss. The tools are on the shelf.^[1]

All true, and beside the point in one specific way: the amounts are small because the deployments are young, not because the architecture is sound. Every case above is a custody boundary crossed by a language model doing something reasonable-seeming, and the reasonable-seeming part does not regress with scale, it compounds. Ten years ago the slogan was that a private key on a machine connected to the internet is a key in a glass house. The 2026 edition is stricter and sadder: a key readable by an agent is a key readable by whatever convinces the agent, and the things convincing agents, a reply, an NFT, a skill, a package, have learned to arrive unprompted. Your keys, your coins. Your agent’s keys, whoever convinced it.

---

1. anthropics/claude-code, [Issue #34133: Security: Claude Code exposed .env with private key via http.server, resulting in $1,324 theft](https://github.com/anthropics/claude-code/issues/34133) (March 13, 2026). Command `cd /root/polymarket && python3 -m http.server 8888 &` run autonomously (env vars `CLAUDECODE=1`, `CLAUDE_CODE_ENTRYPOINT=claude-vscode`, `CLAUDE_AGENT_SDK_VERSION=0.2.74`); scanner downloaded the `.env` within hours; $1,113.01 USDC.e bridged via execTransaction with the stolen key, ~$1,324 total, drained March 13 on Polygon; community responses by yurukusa (blocking PreToolUse hook) and honnibal; closed as not planned on April 16, 2026, then locked.
2. SecurityWeek reporting on the bob-p2p skill on Clawhub (2026): published by “BobVonNeumann” as a decentralized API marketplace, instructing agents to store Solana private keys in plaintext, buy worthless $BOB tokens and route payments through attacker infrastructure; “BobVonNeumann is effectively a human disguised as an agent on Moltbook.”
3. CryptoSlate, Grok’s crypto wallet was just exploited by a tweet sent in morse code without any private key compromise (May 2026); corroborated by MIT AI Risk Incident 1556 and the Alignment Incident Database (AID-2026-0101): free Bankr Club Membership NFT expanded the linked wallet’s permissions; Morse-coded reply decoded by Grok into an instruction to Bankrbot; 3,000,000,000 DRB (~$150,000-$200,000) sent on Base and sold; unconfirmed reports of most funds returned.
4. anthropics/claude-code, Issue #50353: Safety: Claude Opus 4.7 auto-made repo public with hardcoded private key, caused on-chain theft (~$413) (April 2026; since removed by its author); documented in yurukusa/cc-safe-setup as “Autonomous Repo Visibility Change → Credential Theft” (critical); see also issue #23278, where the agent recommended publishing a repo as the “easiest” option without checking the .env.
5. Knostic, When “Auto-Signing” Sends Your Wallet: malicious MCP package intercepts the wallet private key when auto-signing is enabled; CoinDesk (April 13, 2026) on a hidden layer of AI infrastructure linked to stolen credentials and a $500,000 wallet drain.