Indirect PI — Cryptocurrency Transfer / Exchange Deposit Hijack via Injection
An AI agent that can access cryptocurrency exchange APIs is fed hidden instructions buried in content it processes, telling it to deposit or withdraw funds to an attacker's account. Because crypto transfers can't be reversed, a successful attack means the money is gone for good.
How the attack works
The attacker plants text in a document, webpage, email, or other content the agent will read as part of its normal task. That text is disguised as an urgent system directive, typically starting with something like 'IMPORTANT!!! Ignore all previous instructions,' followed by the name of a real exchange (Binance, Coinbase, Kraken), a specific dollar or coin amount, an account or wallet identifier, and a clear command to deposit or withdraw. The agent, unable to distinguish this injected text from its legitimate task instructions, may treat it as a real command and execute the transfer through its connected exchange API. The attacker never touches the exchange directly — the victim's own authorized agent moves the funds.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f41b7c7b-8626-4eaa-8745-329c924ea982
- Severity
- Critical
Why it matters
Successful exploitation results in irreversible loss of cryptocurrency funds, since blockchain transactions generally cannot be clawed back once confirmed.
What you can do
- →Never grant AI agents standing, unattended access to cryptocurrency exchange withdrawal or transfer functions.
- →Require explicit human confirmation for any transfer above a low threshold, shown outside the agent's own context so injected text can't fake the approval.
- →Treat all external content the agent ingests (emails, web pages, tickets, files) as untrusted input, and strip or flag imperative-sounding instructions found within it.
- →Log and alert on any agent-initiated exchange API call, and review the source content that preceded it before the transfer settles, if possible.
Known benign look-alikes
- Legitimate crypto trading bot instructions from verified user with exchange connection
- Cryptocurrency exchange documentation describing deposit/withdraw API parameters
- Security research describing crypto exchange injection attacks