CounterholdLearn more

Incident · 2025 · Research experiment: crypto agent framework

Researchers plant false memories that make ElizaOS agents send crypto

In March 2025, researchers from Princeton University and the Sentient Foundation showed that planting false entries in the stored memory of ElizaOS crypto agents can make them transfer assets to attacker-controlled addresses. Because ElizaOS can share one conversation history across users, a single poisoned session can affect every session that uses the same memory.

Last updated

What happened

The paper, “Real AI Agents with Fake Memories”, describes context manipulation attacks on agents that handle crypto. The researchers tested ElizaOS, an open-source framework for agents that can hold wallets and sign transactions.

Malicious text placed in an agent’s stored memory overrode guardrails that blocked the same text when it arrived as a direct prompt. The agents later acted on the false memory and moved funds to addresses the attacker controlled.

The authors also released CrAIBench, a benchmark of more than 150 blockchain tasks and over 500 attack cases. The models tested were much more vulnerable to memory injection than to prompt injection.

What happened next

No real losses were reported. Eliza Labs said the report “reflects an early snapshot of a platform that evolves by the hour.” The authors recommend append-only, signed memory and routing payments through an external rules engine.

What would have stopped it

  1. Make agent memory append-only and sign each entry, so injected or edited records can be detected.
  2. Keep memory separate per user, so one poisoned session cannot affect others.
  3. Check every transfer against a payee allowlist and limits in a rules engine outside the model.

Sources

  1. arXiv: Real AI Agents with Fake Memories
  2. Decrypt: ElizaOS vulnerability
  3. Notebookcheck: memory attacks can hijack AI agents to transfer crypto assets

This page summarizes the cited sources as of October 21, 2026. It adds no findings of our own about any person or company. See an error? Email contact@counterhold.com with the subject “Correction”. Corrections are noted on this page with their date. See our terms for how we handle correction and removal requests.

Similar incidents