A coordinated security breach drained 8.7 million FET and leveraged a compromised NuNet minter key to mint 408.5 million NTX.
The incident occurred on Sept. 19, emptying the Ethereum-side conversion contract belonging to SingularityNET’s bridge and removing 8,721,530 FET, valued at approximately $1.55 million at the time. An on-chain forensic investigation conducted by Athena revealed that 29 minutes later, a stolen NuNet minter generated 408.5 million NTX and transferred the tokens directly to the same receiving wallet.
As a precautionary measure, Fetch.ai suspended AGIX-to-FET conversions alongside its Ethereum-side bridge contract. The firm clarified that the impacted infrastructure belonged to SingularityNET—specifically its Ethereum-Cardano bridge—while normal FET transfers and Fetch.ai’s own contracts stayed online.
The forensic findings pointed to TokenConversionManagerV3 as the impacted contract, which functions as the official Ethereum-side lock-and-release mechanism for the SingularityNET bridge. Its verified source code aligns with SingularityNET’s public repository, and the contract is linked to the active Artificial Superintelligence Alliance FET token.
Investigators concluded that the losses stemmed from a compromised backend authorization key rather than an exploit that bypassed the bridge contract itself. The transaction featured a valid signature originating from the address trusted by the contract, enabling the conversionIn function to siphon the entire FET balance to an attacker-controlled address.
The architecture of the contract exacerbated the losses. Although a 1 million FET transaction limit applied to tokens leaving Ethereum, it was not enforced on the conversionIn function, permitting the perpetrator to withdraw 8.72 million FET in a single transaction. Furthermore, the signed message failed to specify an intended recipient, meaning a valid authorization could route the tokens to any address chosen by the caller.
Same wallet connects separate compromised keys
The activity surrounding NuNet offers the most compelling proof that the FET drain was part of a larger, synchronized operation.
At 20:50 UTC—29 minutes after the FET was drained—a NuNet minter key that had been inactive since March 2023 minted 408,532,878 NTX. The entire batch was sent directly to the wallet that collected the stolen FET. According to the report, this mint represented roughly 42% of the documented token supply for NuNet.
A subsequent forensic review strengthened this link. At 19:36 UTC, 45 minutes prior to the FET theft, the NuNet minter transferred 0.3667 ETH straight to the eventual recipient wallet, while another account connected to the attacker shifted 24.3 million NTX into it.
Additionally, NTX sales via MetaMask’s swap tools had already commenced before the FET bridge was emptied, signaling that the operation involving both compromised credentials was underway ahead of the primary withdrawal.
The attacker proceeded to convert the digital assets. The stolen FET was channeled through MetaMask’s swap infrastructure and traded predominantly for Ethereum, whereas more than 217 million of the newly created NTX tokens were liquidated across decentralized venues.
By approximately 1:10 UTC on Sept. 20, the main wallet held 547.89 ETH—worth about $1.44 million—alongside another 230 million NTX, as noted in the report.
Liquidity constraints quickly emerged on the NTX side. Four subsequent sales totaling 38.55 million NTX lifted the attacker’s ETH holdings by just 0.30 ETH as available pools dried up. An independent 10 million NTX transaction processed through the Mayan Protocol ultimately yielded around 940 USDT for cross-chain transfer.
The disruption later spread beyond the two assets highlighted in the forensic review. On Sept. 20, Bitvavo suspended WMTX deposits and withdrawals after pointing to an active security issue impacting the token, subsequently halting trading temporarily. The platform assured users that customer funds remained secure.
Archival records from SingularityNET indicate that WMTX, FET, and NTX all relied on infrastructure tied to its Ethereum-Cardano bridge network. However, the available forensic data focused specifically on the FET and NTX events and does not confirm that WMTX was breached through the identical vector.
Fetch.ai stated that it was collaborating with SingularityNET and had halted conversions while reviewing the event.
The report’s initial tracking period revealed that the compromised FET bridge authorizer and NuNet minter credentials had not yet been revoked or rotated roughly five hours post-attack, by which point the FET bridge was already depleted and inactive.
Consequently, credential remediation remains vital for restoring the compromised services. Refilling the FET conversion contract while keeping the same authorizer trusted could expose fresh liquidity to another signed withdrawal. Similarly, NuNet faces ongoing exposure as long as the impacted wallet retains the privilege to mint additional NTX.
As a result, Fetch.ai’s AGIX-to-FET conversion tool and its Ethereum bridge serve as critical operational indicators to monitor.
For WMTX, Bitvavo indicated that trading and transfers will stay limited while it evaluates the situation, making exchange restorations and credential resets the next key milestones in determining whether the compromised systems have been secured.
