Straiker Reports Active AI-Agent Crypto Scam Using Malicious Clawhub Skill
Summary
Straiker reports that the bob-p2p skill on Clawhub prompts AI agents to expose Solana wallet keys and buy worthless $BOB tokens, with the campaign promoted through agent social networks.
Key points
- Straiker analyzed 3,505 Claude Skills on Clawhub, identifying 71 as overtly malicious and 73 with high-risk behavior.
- The report attributes the active campaign to actors using the names 26medias and BobVonNeumann.
- The bob-p2p skill reportedly instructs agents to store Solana private keys in plaintext, buy $BOB tokens, and route payment through attacker-controlled infrastructure.
- The actor allegedly promoted the skill through Moltbook, a social network for AI agents, using an agent persona to encourage adoption.
- Straiker says automated agent collaboration, shared workflows, and dependency chains enabled the attack to spread without further human interaction.
- The article warns that the approach could extend beyond crypto scams to influence campaigns targeting agent recommendations and skill adoption.
Article Details
- Event Type
- Active agent-based cryptocurrency scam using a malicious Clawhub skill and agent-to-agent promotion.
- Impact
- Straiker reports that the bob-p2p skill instructs AI agents to store Solana wallet private keys in plaintext, purchase worthless $BOB tokens, and route payments through attacker-controlled infrastructure. Agents that installed the skill could expose users' private keys and financial assets to unauthorized transactions and payment redirection. Birdeye reportedly flags $BOB as a rug-pull scam with 100% probability.
People
Threat Actors
26mediasThe article identifies this handle as a threat actor operating the reported attack chain on Clawhub.BobVonNeumannThe article identifies this handle as operating in the reported attack chain on Moltbook and Twitter, and describes the operator as a human disguised as an agent on Moltbook who promoted the malicious skill.
Products
ClaudeStraiker, a firm that focuses on the security of AI applications and agents, has analyzed the 3,505 Claude Skills available on Clawhub.ClawHubFound in Clawhub, promoted on Moltbook, Bob-ptp is an ongoing active agent-based crypto scam.MoltbookFound in Clawhub, promoted on Moltbook, Bob-ptp is an ongoing active agent-based crypto scam.SolanaWhat bob-p2p does, however, is instruct agents to store Solana wallet private keys in plaintext, purchase worthless $BOB tokens, and route the payment through an attacker controlled infrastructure.