The attack began on September 19, targeting Fetch.ai, NuNet, and SingularityNET. PeckShield analysts reported that an exploiter used a valid signature to withdraw 8.7 million FET tokens worth approximately $1.53 million from the Fetch.ai conversion contract. The attacker also minted 408.5 million NTX tokens, increasing the total supply to 1 billion.
On September 20, the incident expanded to the SingularityNET bridge on Ethereum. The attacker minted 260 million AGIX and 53.838 million WMTx tokens without collateral. World Mobile confirmed the unauthorized WMTx minting and revoked token creation rights, though the Cardano network and World Mobile infrastructure remained unaffected.
Bitquery analysts later identified a larger scale of unauthorized activity, including the minting of 896 million AGIX, 500.5 million WMTx, 492.4 million CGV, and 408.5 million NTX. The total volume of affected tokens reached 2.3 billion units. Experts estimate the realized assets and remaining funds on the attacker's addresses at approximately $2.25 million.
Investigations revealed that ETH used for the attack originated from 16 wallets, four of which were linked to employees of SingularityNET or NuNet. This suggests a compromise of multiple private keys. In response, Fetch.ai and SingularityNET disabled affected contracts and wallets, while suspending the AGIX to FET conversion and the Fetch.ai Ethereum bridge.
