{"meta":{"exportedAt":"2026-10-25T06:35:53.975Z","formatVersion":2,"selection":{"q":"malicious-code","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"2024","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":0,"languages":1,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":1,"contextualRelations":0,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2024-crypto-user-says-chatgpt-written-trading-bot-code-sent-wallet-private-key-to-scam-api-and-about-2500-dollars-was-stolen","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"Today I was trying to write a bump bot for https://t.co/cIAVsMwwFk and asked @ChatGPTapp to help me with the code. I got what I asked but I didn’t expect that chatGPT would recommend me a scam @solana API website. I lost around $2.5k","relation":"supports","source_id":"s3"},{"locator":"What he did not expect was that ChatGPT would suggest a fraudulent Solana API website.","relation":"supports","source_id":"s1"}],"assertion":"The user says he asked ChatGPT to help write a bump bot for Pump.fun and that ChatGPT recommended a scam Solana API website in the code.","causal_attribution":"His own X post, embedded by Cryptopolitan and paraphrased by Heise; one origin."},{"id":"c2","status":"reported","evidence":[{"locator":"He explains that he took code suggested by ChatGPT that transmits the private key via the API. He also used his main Solana wallet.","relation":"supports","source_id":"s1"},{"locator":"The victim showed part of the code where it was necessary to send a private key to the API as recommended by ChatGPT.","relation":"supports","source_id":"s2"}],"assertion":"By his account the code sent the wallet private key to that API, and he had connected his main wallet.","causal_attribution":"His own account and screenshot as described by two outlets; one origin."},{"id":"c3","status":"reported","evidence":[{"locator":"This took place within 30 minutes after he had sent a request.","relation":"supports","source_id":"s1"},{"locator":"linked his main wallet and lost $2,500 as a result.","relation":"supports","source_id":"s4"}],"assertion":"About $2,500 was taken from the wallet, moved to another address within about half an hour.","causal_attribution":"His account of the loss as relayed; the amount is his estimate."},{"id":"c4","status":"reported","evidence":[{"locator":"In this regard, Yu Xian characterized the root cause of the incident as \"AI poisoning attack\" and pointed out that there is widespread deception in LLMs such as ChatGPT and Claude.","relation":"supports","source_id":"s4"},{"locator":"The founder of the SlowMist on-chain security firm corroborated the story, stating that the most probable explanation was that the user was playing around with AI without verifying the code. The end product was a functional bot with a carefully disguised backdoor.","relation":"supports","source_id":"s3"}],"assertion":"SlowMist's founder characterised the cause as an AI poisoning attack, saying the bot code had a backdoor.","causal_attribution":"The security firm founder's public comment after looking at the wallet, as relayed; it is his explanation, not an established cause."},{"id":"c5","status":"reported","evidence":[{"locator":"He reported the chat history with the fraudulent program code to OpenAI. He informed Github about the fraudulent repository, whereupon it was quickly removed.","relation":"supports","source_id":"s1"}],"assertion":"He reported the chat history to OpenAI and the repository to GitHub, which removed it.","causal_attribution":"Heise's account of his posts."},{"id":"c6","status":"reported","evidence":[{"locator":"The code snippet, of which he shows a screenshot, even openly states what it does: \"Payload for POST request\" can be read as a comment, which is followed by the private key that programmers are supposed to enter.","relation":"supports","source_id":"s1"}],"assertion":"Heise notes that the code's comment openly showed the private key being sent and that he used his main wallet instead of a test account.","causal_attribution":"Heise's own assessment of the screenshot; counterevidence on his own part in the loss."}],"effects":[{"label":"about $2,500 taken from his main crypto wallet (his account)","claim_id":"c3","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.heise.de/en/news/ChatGPT-Code-with-fraudulent-API-costs-programmers-2500-US-dollars-10169338.html","kind":"news_report","access":"read","language":"en","translation_note":"Read in English by the research agent (an AI) on 2026-10-25 from Heise's print view (HTTP 200). Heise says the English text was translated from its German original with technical assistance and editorially reviewed.","independence_group":"user-x-thread-and-slowmist-founder-post-nov-2024"},{"id":"s2","url":"https://forklog.com/en/chatgpt-recommendation-leads-to-phishing-loss-for-crypto-user/","kind":"news_report","access":"read","language":"en","translation_note":"Read in English by the research agent (an AI) on 2026-10-25 (HTTP 200); it relays the X posts of the user and the SlowMist founder, the latter in Chinese with an English rendering.","independence_group":"user-x-thread-and-slowmist-founder-post-nov-2024"},{"id":"s3","url":"https://www.cryptopolitan.com/solana-wallet-exploit-ai-poisoning-attack/","kind":"news_report","access":"read","language":"en","translation_note":"Read in English by the research agent (an AI) on 2026-10-25 (HTTP 200); it embeds the user's X post.","independence_group":"user-x-thread-and-slowmist-founder-post-nov-2024"},{"id":"s4","url":"https://www.odaily.news/en/post/5199958","kind":"news_report","access":"read","language":"en","translation_note":"Read in English by the research agent (an AI) on 2026-10-25 from Odaily's English page (HTTP 200), which describes the user's screenshots and the SlowMist founder's comment.","independence_group":"user-x-thread-and-slowmist-founder-post-nov-2024"}],"version":1,"ai_roles":["own_use"],"contexts":["finance","everyday_life"],"unknowns":["When the conversation and the theft happened beyond his post of 21 November 2024.","The full ChatGPT conversation, and whether ChatGPT produced the API address itself or reproduced it from code it drew on.","Whether OpenAI responded or any funds were recovered."],"geography":{"basis":"No source states where the user lives or where the loss occurred; no country is recorded.","court_countries":[],"event_countries":[],"affected_person_countries":[]},"publication":{"basis":"Published as a concrete first-person account, relayed by four outlets, that code ChatGPT wrote at the user's request sent his wallet's private key to a scam API, after which about $2,500 was taken. The account is attributed and uncorroborated; a security firm founder's comment and the outlets' criticism of his own handling are recorded.","reviewed_on":"2026-10-25"},"ai_involvement":{"basis":"The user says ChatGPT, asked to help write a trading-bot script, returned code that pointed to a scam Solana API website and sent his wallet's private key to it, and that running the code with his main wallet led to the theft; outlets describe his screenshots of the code, and the SlowMist founder said the bot code carried a backdoor. The conversation itself is not published, so the AI output rests on his account and screenshots.","status":"reported"},"person_relations":["communicated_with"]},"name":"Crypto user says ChatGPT-written trading bot code sent his wallet's private key to a scam API and about $2,500 was stolen","summary":"On 21 November 2024 a cryptocurrency user posted on X that he had asked ChatGPT to help write a 'bump bot' for the Pump.fun token platform, and that the code it returned pointed to a scam Solana API website. By his account, the code sent his wallet's private key to that API; he had connected his main wallet, and its assets, about $2,500, were moved out within about half an hour. The founder of the blockchain security firm SlowMist commented that the bot code carried a backdoor and called the case an AI poisoning attack. Heise, ForkLog, Cryptopolitan and Odaily relayed the posts on 22 and 25 November 2024. He said he reported the chat to OpenAI and the source repository to GitHub, which removed it. Heise noted that the code's own comment showed the private key being sent and that he had used his main wallet rather than a test account.","incidentDate":"2024-11-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"single_interaction","reportedDate":"2024-11-22","aiSystem":"ChatGPT, which the user says wrote the bot code and in doing so pointed it to a scam Solana API website","aiProduct":"ChatGPT (reported)","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["financial_loss"],"harmOutcomeSummary":"The user says the ChatGPT-written bot code sent his wallet's private key to a scam API and about $2,500 was taken from his main wallet (his public account, relayed by four outlets).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":1,"otherPeopleHarmedMin":0,"affectedCountStatus":"exact","affectedCountEvidence":"One person: the user who posted. Other wallets drained by the same address (Cryptopolitan) are not described as ChatGPT users and are not counted.","victimAgeRange":"adult","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.heise.de/en/news/ChatGPT-Code-with-fraudulent-API-costs-programmers-2500-US-dollars-10169338.html","primarySourceLabel":"Heise online (English edition), 25 Nov 2024: ChatGPT code with a fraudulent API costs a programmer 2,500 US dollars","firstPublishedAt":"2026-10-25T03:20:25.096615+00:00","updatedAt":"2026-10-25T03:20:25.096615+00:00","scopeVersion":"facts-v3","tags":["chatgpt","cryptocurrency","malicious-code","phishing","financial-loss"]}]}