A coordinated attack drained 8.7 million FET and used a compromised NuNet minter key to create 408.5 million NTX.

The Sept. 19 attack emptied the Ethereum-side conversion contract used by SingularityNET’s bridge, removing 8,721,530 FET worth about $1.55 million at the time. Twenty-nine minutes later, a stolen NuNet minter created 408.5 million NTX and sent the tokens to the same receiving wallet, according to an on-chain forensic report prepared by Athena.

Fetch.ai subsequently paused AGIX-to-FET conversions and its Ethereum-side bridge contract as a precaution. The company said the affected infrastructure belonged to SingularityNET, primarily its Ethereum-Cardano bridge , while Fetch.ai’s own contracts and normal FET transfers remained operational.

The forensic report identified the affected contract as TokenConversionManagerV3, the legitimate Ethereum-side lock-and-release component of SingularityNET’s bridge. Its verified source matches SingularityNET’s public repository, and the contract is tied to the current Artificial Superintelligence Alliance FET token.

Investigators traced the loss to a compromised backend authorization key, not a flaw that let an attacker bypass the bridge contract. The transaction carried a valid signature from the address the contract was configured to trust, allowing its conversionIn function to release the entire FET balance to an attacker-controlled wallet.

The contract’s design magnified the damage. Its 1 million FET transaction cap applied to tokens moving out of Ethereum but was not enforced on conversionIn , allowing the attacker to withdraw 8.72 million FET in one transaction. The signed message also failed to bind the eventual recipient, meaning a valid authorization could direct the tokens to an address selected by the caller.

The NuNet activity provides the strongest evidence that the FET drain formed part of a broader coordinated operation.

At 20:50 UTC, 29 minutes after the FET withdrawal, a NuNet minter key dormant since March 2023 created 408,532,878 NTX and sent the entire amount to the same wallet that received the stolen FET. The mint was equivalent to roughly 42% of NuNet’s documented token supply, according to the report.