This is a centralized exchange. This attack could be mitigated by encouraging users to move their funds to their own wallets.

True, but it may also allow malevolent people to take control of hardware they do not own.

Well, if you’re being pedantic: prompt doesn’t seem to fit as it refers to the “user” turn, and not the thread resulting of the back and forth communication between the “user” and “assistant”.