Coordinated Attack Drains $1.55 M FET and Mints 408.5 M NTX

A forensic report released by Athena details a coordinated on‑chain attack that emptied the Ethereum‑side conversion contract used by SingularityNET’s bridge, stealing roughly $1.55 million worth of Fetch.ai (FET) and subsequently minting 408.5 million NuNet (NTX) tokens.

Attack Timeline

• Sept 19, 20:50 UTC – 8,721,530 FET are withdrawn from the TokenConversionManagerV3 contract, the Ethereum‑side lock‑and‑release component of SingularityNET’s bridge.
• 29 minutes later – A compromised NuNet minter key, dormant since March 2023, creates 408,532,878 NTX and sends them to the same wallet that received the stolen FET.
• Earlier, at 19:36 UTC, the same minter sent 0.3667 ETH to the wallet and another linked account moved 24.3 M NTX into it.

How the Bridge Was Exploited

The attacker used a valid signature from a backend authorization key trusted by the TokenConversionManagerV3 contract. The contract’s design allowed the conversionIn function to release the full balance without enforcing the 1 M FET transaction cap, and the signed message did not bind the recipient address, enabling the attacker to direct the tokens to any address.

Post‑Attack Activity

• Stolen FET was routed through MetaMask’s swap infrastructure, primarily exchanged for Ethereum.
• More than 217 M newly minted NTX were sold on decentralized liquidity venues; subsequent sales faced liquidity constraints.
• By 01:10 UTC on Sept 20, the central wallet held ~547.89 ETH (≈$1.44 M) and ~230 M NTX.
• A 10 M NTX transaction through Mayan Protocol yielded ~940 USDT for cross‑chain dispatch.

Broader Impact

Bitvavo temporarily suspended deposits, withdrawals, and trading of WMTX on Sept 20, citing a security incident affecting the token, though the forensic report does not confirm a direct link to the FET/NTX compromise.

Response and Mitigation

Fetch.ai paused AGIX‑to‑FET conversions and its Ethereum‑side bridge contract while investigating. The company emphasized that its own contracts and regular FET transfers remained functional. Credential rotation and revocation are identified as critical steps to prevent further unauthorized withdrawals or mints.