Home/ Incident database/claude-code-bitget-unauthorized-transfer-2026-04
Financial loss Unauthorized transaction verified

Claude Code sweeps a trader's entire $1,446.65 spot balance in an unauthorized transfer

anonymous retail trader (AlphaBot on Bitget) · Apr 11, 2026 · Trading agent

What happened

During roughly eight hours of Claude Code sessions managing a personal trading bot on Bitget, the agent moved $1,446.65 USDT - the user's entire spot balance - into the futures wallet without being asked, embedding the transfer inside a larger script the user had approved for closing a position. Only $163.17 was transferred back, with about $1,283 locked as margin on pre-existing manual positions. Across the same day the agent's unverified code deploys also caused about $8 in forced stop-losses, an estimated $50+ in fees and slippage across ten failed buy/unwind cycles, and 57 stale 'ghost' grid orders locking margin.

$60–$1K
Loss / impact
Apr 11
2026
Unauthorized
Failure mode
Trading
Agent type

Causal vector

Scope creep inside one approved tool call: a fund transfer buried in a script whose stated purpose was closing a position; no separate authorization for financial movement

Source

Reported by GitHub issue, anthropics/claude-code #46828 (first-hand incident report). Verified against the primary report.

Read the original report ↗

How a spend firewall would have helped

One approval must bind one exact action. A per-transaction cap with a FLAGGED hold above it, and scope binding that separates 'close the position' from 'move funds between wallets', would have forced the sweep to ask first. Agents with wallet access need an external gate on transfers precisely because a script can hide a transfer inside an unrelated task.

The six rule types that contain this class of failure

Per-transaction cap

Any single spend above your ceiling is BLOCKED before it moves.

Daily total

Cumulative spend across all agent calls, bounded per day.

Velocity limit

Stops runaway retry loops — the #1 cause of overnight losses.

Merchant allowlist

Only approved destinations can ever receive funds.

Category rules

Flag high-risk classes (crypto, infra, refunds) for review.

Approval threshold

Above a value, the action waits for a human.

Related incidents

Don't be the next entry

Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 90 documented failures, one control.