Attacker Exploits Signing Keys to Drain Fetch.ai and Mint NTX, Netting $2 Million

An attacker who obtained a valid signing key targeted two separate projects within the same minute, draining a Fetch.ai token converter and creating a massive new supply of Nunet (NTX) tokens. The combined impact was estimated at about $2.01 million.

Fetch.ai Converter Compromise

The Fetch.ai TokenConversionManagerV3 contract accepted a conversion‑authorizer signature through its conversionIn() function. Because the function lacked the checkLimits(amount) modifier and did not verify that tokens were locked or burned elsewhere, the compromised signing key allowed the attacker to submit a valid message directing the converter’s remaining inventory to their address. Approximately 8,721,530 FET, valued at roughly $1.55 million, were removed.

NTX Minting Attack

In a separate but simultaneous exploit, the attacker used a compromised minting key to create about 408.5 million new NTX tokens. This amount represented roughly 42 % of NTX’s total supply, causing the token’s price to plunge from around $0.0013 to below $0.0004 as liquidity evaporated.

Aftermath and Fund Movement

Security firms PeckShield and Blockaid traced both activities to the same wallet cluster. The stolen assets were quickly swapped for approximately 546.36 ETH, worth about $1.44 million at the time. Fetch.ai later reported a balance of roughly 547.89 ETH and 230 million NTX remaining in the compromised wallet.

Open Questions

Investigators have identified the compromised signing keys—one used by SingularityNET’s cross‑chain bridge for FET and another for NTX minting—but the method of key extraction (phishing, server intrusion, backup leak, etc.) remains undisclosed. The large amount of newly minted NTX that has not been sold poses ongoing market and regulatory concerns.

Impact on Users

Fetch.ai confirmed that treasury funds, exchange wallets, and user‑held tokens were not affected. The team is working with SingularityNET to disable the compromised wallets and contracts and has warned users to ignore unsolicited messages and rely only on official communications.