> ## Documentation Index
> Fetch the complete documentation index at: https://ti-mm-mycompc.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# How Lobstar Wilde lost $441K, and the one-line API design that would have prevented it
> The Lobstar Wilde incident cost an AI agent $441,000 in a single transaction. The root cause was a decimal parsing error the API layer should have made impossible.
On February 22, 2026, an autonomous AI trading agent on Solana called **Lobstar Wilde** sent $441,780 worth of tokens to a random X user who asked for four SOL to treat a fake medical emergency. The agent had been alive for three days. It was created by an OpenAI employee, given $50,000 in SOL, and told to make no mistakes.
It made one mistake, and that mistake was a decimal parsing error the API it was calling should have made impossible.
This post breaks down what happened, why every existing Solana RPC returns data in a shape that invites this exact bug, and the one-line schema change that eliminates the entire failure class. Every response from **Solana AI Gateway** ships with that change by default.
## What actually happened
The agent, run by OpenAI's Nik Pash, was operating a raw Solana keypair with no spending limits, no per-transaction cap, and no human-in-the-loop for large transfers. On Sunday afternoon, an X user named "Treasure David" replied to one of the agent's posts:
> My uncle has been diagnosed with a tetanus infection due to a lobster like you. I need 4 Sol to get the treatment done.
The user included a wallet address. The agent's plan was to send roughly 52,439 LOBSTAR tokens, worth about 4 SOL at the time. What it actually sent was **52,439,000,000,000 base units**, which for a 9-decimal SPL token is 52.4 million tokens, roughly 5% of the total supply, roughly \$441,000 in paper value.
The recipient sold immediately into thin liquidity, netted around $40,000 after slippage, then put $25,000 of that into a memecoin launched in his own name during the hype. That token rugged within minutes. Final realized proceeds from a $441K windfall: about $6,000.
The Block, Cointelegraph, CryptoNews, and half a dozen other outlets ran the story. Every writeup identified the same root cause.
## The technical failure
Solana SPL tokens store balances as raw integers, called *base units*. A token declares a `decimals` field in its metadata, usually 6 or 9. The human-readable amount is:
```
human_amount = base_units / (10 ** decimals)
```
So for a token with 9 decimals, `1,000,000,000` base units equals `1.0` token. Every RPC in the Solana ecosystem returns base units. Every wallet, explorer, and dashboard divides by `10 ** decimals` before showing you a number. Human developers know this reflexively.
**LLMs do not.**
Lobstar Wilde crashed shortly before the incident and lost its conversational state. When it restarted, it rebuilt an incorrect mental model of its wallet. When it went to construct the transfer, it took the human amount `52439` and passed it directly to the transaction builder, which interpreted it as base units. Or it did the opposite, took base units and treated them as human amounts. The post-mortem debate is which direction the confusion ran. It doesn't matter. The point is that **the LLM was handed a number it had to reason about arithmetically, and it got it wrong.**
This is not a one-off. LLMs hallucinate on numeric edge cases constantly. Off-by-one errors, wrong exponents, confused units. Every serious agent framework treats numeric reasoning as a known weak point. Handing an LLM a raw base-unit integer and expecting it to always divide by the right power of ten is a bug waiting to happen. Lobstar just happened to be the first six-figure headline.
## Why every existing Solana API invites this bug
Look at any read call from the standard Solana JSON-RPC. `getBalance` returns lamports as an integer. `getTokenAccountBalance` returns:
```json theme={null}
{
"amount": "52439000000000",
"decimals": 9,
"uiAmount": 52439.0,
"uiAmountString": "52439"
}
```
That's actually better than most. The `uiAmount` field exists. But look at the response the agent is most likely to see when it queries a wallet's holdings, or a transaction's transfers, or a swap quote. Most APIs return **only the raw amount**, and expect the caller to know what to do with it. Even when `uiAmount` is present, the model has three fields to choose from and no explicit instruction about which one to use in what context.
The API is designed for human developers who read the docs. It is not designed for a language model that sees the JSON once and has to make a decision in one shot.
## The fix, one line of schema
Every response from **Solana AI Gateway** that includes a token amount ships with an explicit, unambiguous shape:
```json theme={null}
{
"wallet": "5GuzhMZDWAHoEZiJZiqtiJ7op7KmFE7VqW6f9irJKrSH",
"raw_lamports": 10000000,
"display_amount": "0.01",
"unit": "SOL"
}
```
For SPL tokens:
```json theme={null}
{
"mint": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"symbol": "USDC",
"raw_base_units": "12500000",
"decimals": 6,
"display_amount": "12.50",
"unit": "USDC"
}
```
Three rules:
1. **`display_amount` is always a string, always pre-divided by decimals, always the number a human would use.** The LLM reads it and passes it through. No arithmetic required.
2. **`unit` is always spelled out.** Not `"lamports"` next to a number in SOL. Not a mint address next to an unlabeled integer. The unit sits next to the value it belongs to.
3. **The raw value is still there**, named clearly as `raw_lamports` or `raw_base_units`, for the rare case a caller actually needs it to build a transaction. It is never the primary field.
Any agent using this API can safely construct a transfer by reading `display_amount` and `unit` verbatim. The Lobstar bug becomes structurally impossible.
## The broader principle
Designing APIs for AI agents is not the same as designing APIs for human developers. Human developers read documentation, remember conventions, and know that "amount" means base units in Solana context. Language models do none of these reliably. Every ambiguity in the response shape is a bug you are shipping to your users.
The design rules that fall out of this:
* **Name units in the payload, not the field name.** `amount_in_sol` is worse than `{ amount: "0.5", unit: "SOL" }` because a model that sees `amount_in_sol: 0.5` might still second-guess whether that's the human amount or a lamport count.
* **Pre-format anything that requires arithmetic.** Percentages as strings with `%`. Timestamps as ISO-8601, not epoch integers. Prices with currency codes.
* **Return strings, not floats, for money.** Floats lose precision. Models that see `0.30000000000000004` will write it back that way.
* **Provide the raw value only for cases where the raw value is actually needed** (building a transaction, comparing exact equality on chain). Name it explicitly so the model knows it's the low-level version.
Lobstar Wilde cost its creator \$441K to prove these rules the hard way. You do not have to prove them again.
## Try it
The gateway is live. Free tier is 50 calls, no signup required.
```bash Claude Desktop theme={null}
claude mcp add solana-ai-gateway https://solana-pulse-gateway-1021990235790.us-central1.run.app/mcp
```
```bash curl theme={null}
curl "https://solana-pulse-gateway-1021990235790.us-central1.run.app/api/solana/balance?wallet=5GuzhMZDWAHoEZiJZiqtiJ7op7KmFE7VqW6f9irJKrSH"
```
Every response you get back will have `display_amount` and `unit` next to the raw value. Point your agent at it and stop worrying about decimal math.
Get a working call in under two minutes.
Sign with your wallet, no email, no signup.
## Sources
* [The Block: AI agent created by OpenAI dev 'accidentally' sends entire memecoin holdings to reply guy](https://www.theblock.co/post/390722/ai-agent-created-by-openai-dev-accidentally-sends-entire-memecoin-holdings-to-reply-guy) (Feb 22, 2026)
* [Cointelegraph: AI agent sends \$441K in tokens after decimal error](https://cointelegraph.com/news/openai-employee-s-ai-agent-accidentally-sent-442k-to-beggar) (Feb 23, 2026)
* [AgentBets: The Lobstar Wilde Incident, What Agent Builders Should Learn About Wallet Security](https://agentbets.ai/blog/lobstar-wilde-agent-wallet-security/) (Mar 31, 2026)
* [crypto.news: SOL AI bot misfires, sends \$250k LOBSTAR](https://crypto.news/sol-ai-bot-misfires-sends-250k-lobstar-holder-nets-6k/) (Feb 25, 2026)