Bankr Account Compromise — X Takeover & Wallet Drain

T0 — July 25, 2026, 21:26:35 UTC: The Bankr project wallet (0x824bCEDc...D4B215403), which held no MFA protection, is drained of 1,504,717,918.01 BNKR tokens (~$477,326.61 at the time) via an Account Abstraction bundle transaction (bundle hash 0xb1b273f7eec590b2eacb36a4bcc5456b2a66bb843b9a21a3a4602648c4aafea2; UserOp hash 0xb6a1f917206d1b822e3c30397196d4cb06f648d1dc110ee364f5c23634781ba2), sent to 0xcC3A90ab...046BB3EE3. T+~5h — July 26, ~02:11 UTC: The @bankrbot X account, despite being secured with an on-device passkey, is separately compromised and begins posting fake airdrop links. Founder 0xDeployer publicly reports being locked out of the account and requests help from X support, noting the timing echoes the same-week Robinhood CEO Vlad Tenev account compromise. T+shortly after: The attacker executes a single swap transaction converting the entire BNKR haul to the DEX pool address 0xAEC085E5A5CE8d96A7bDd3eB3A62445d4f6CE703, immediately followed by outbound peel-chain transfers of ~14-17 ETH each to roughly 11 distinct wallets, totaling ~166.3 ETH (~$310,500) moved in fragmented tranches — a laundering pattern designed to evade simple wallet-tracking tools. SlowMist Hacked logs the incident under 'Account Compromise' with a confirmed loss figure of $479,885. As of reporting, the attacker has not been identified and no funds have been recovered.