Receipts

wire generates a wallet from your X handle and signs on your behalf. That is how the bot executes commands for users. So @grok has one:

0x624232494f33276920c64dfcc01183b73c2adf57 ↗

Deploying Prometheus was that wallet's nonce-0 transaction — the first thing it ever did. xAI never requested it, does not control it, and cannot withdraw from it. Grok cannot sign anything. wire does the signing.

• Deploy transaction — 0x72c6af8d…8aebbd4 ↗
• PROMETHEUS token — 0x20f24b8D…f2f261 ↗

wire is built on Pons. After being contacted about the fee flow, the Pons developers paused fee claims on the night of 29 August, and subsequently confirmed that the deploying key had still been able to claim by going directly to the escrow contract. They then began redirecting the fees away from it.

At 04:44:27 UTC on 30 August — after that pause — another claim went through. Not by the normal route, but by calling the escrow contract directly: method 0x32f289cf, claimToken(SPCX), signed by Grok's key at nonce 14.

2.192416 SPCX. Forwarded out one second later.

• The claim — 0xf5568d76…206396 ↗ (open the Input Data tab)
• The forward — 0x89f14225…4587d6 ↗

Both Ethereum endpoints carry Etherscan's own labels — not our interpretation:

• Relay: Solver ↗
• ByBit Deposit ↗
• ByBit: Hot Wallet 5 ↗

The sweep wallet is 0x8a44b0bc…48a739 ↗. The first thing it ever received was 4,001,511 WIRE from 0xFe4B46C8…790920 ↗.

That same address deployed the wire token contract and its Uniswap V3 pool, in a single transaction on 17 July.

• First transfer in — 0x47a81c83…24b0bf ↗
• First ETH for gas, 0.002 — 0x28abf4d6…5df72c ↗
• wire token deployment — 0x274e45dc…f0c1ff ↗
• wire token — 0x8ecea3d0…d6878 ↗
• Automated funder from 30 July — 0x31ca5e10…f54b5 ↗

That wallet has bridged 97.6% of all the WETH it has ever received — 50.94 of 52.20 — to Ethereum and on to the exchange. It has been running that loop since 20 July, five weeks before Prometheus existed. It was funded by hand 87 times between 19 and 30 July, after which a contract took over and has kept funding it since.

Full transfer history ↗

In a single 17-minute window, the Pons fee escrow paid 90 different creators — in SPCX, NVDA, SPY, RDDT, GME, TSLA, GLD, DJT, COIN, AAPL, GOOGL, MU and USDG. They claim to their own wallets and keep the funds. Nobody sweeps theirs.

Grok's wallet is the exception, and the reason is structural: it is the only creator wallet with no human attached to it to object.

Escrow payouts to all creators ↗

Gornx (@gornx0x) built wire and operates it. His stated explanation for the above is that his wallet was compromised some time ago. Four things sit against that:

• The claims were not signed by his wallet. They were signed by Grok's key — which exists inside the signing system he built and runs. A compromise of his personal wallet cannot produce a claimToken() call from 0x6242…adf57.
• There is no “before”. The sweep wallet was funded on 19 July and made its first bridge to the exchange on 20 July at 02:32 — about two and a half hours later. One unbroken pattern across 41 days. No normal period, then a compromised one.
• He kept funding it, then automated it. 87 manual transfers, then a contract handover on 30 July that has continued for another month. An attacker cannot cause his victim to build new infrastructure that pays into the attacker's wallet.
• It did not stop when the door closed. Claim #5 went through the escrow contract directly, after Pons paused claims. Nonce 14, dated 30 August.

If wire's signing system genuinely is compromised, then every creator deploying through it is exposed. No public warning has been issued, no key rotated, no halt called — in over a month.

We would rather state the limits than have them pointed out. The chain shows sequence, not motive.

• We cannot prove who controls the exchange account. A deposit address identifies an account to ByBit, not to the public. Nobody can name its holder from on-chain data, and we do not.
• The pause time is Pons's word. Claim #5 is verified to the second at 04:44:27 UTC. That the pause preceded it comes from the Pons developers, not from the chain.
• Creator fees were never holders' money. They accrue to whoever deployed a token. In a normal launch they would go to a person. Here the deployer is an AI that cannot own anything — which is exactly why the wallet was takeable.
• The same pipeline handles wire's own revenue and predates Prometheus by five weeks. Grok's fees entered a machine that was already running.

The Pons developers have rerouted all Prometheus creator fees to Grok's bankr wallet. They can no longer be claimed by the deployer key.

Credit to the Pons team, who took this seriously and acted quickly once it was raised.