A single wallet links the $1.55 million FetchAI heist to a whopping 408.5 million NTX add-ons

Overview of the incident: Bridge contract is empty, key synchronization fails

On September 19, a security incident occurred in the SingularityNET ecosystem: an attacker first transferred 872.153 million FETs, worth about $1.55 million per time from its Ethereum-side cross-chain bridge swap contract; only 29 minutes later another stolen NuNet extension key leaked 408.5 million NTX and all of them were transferred to the same receiving wallet. According to Athena's on-line forensic report, both moves pointed towards the same operator, showing that this was an organized collaborative attack.

Following the incident, Fetch.ai cautiously suspended AGIX for FET services and Ethereum side-bridge contracts, emphasizing that the affected infrastructure belongs to SingularityNET, mainly its Cardano bridge on ethereum, while normal transfers of fetch. ai's own contract with FET were unaffected.

Forensic details: The vulnerability is not in the contract, but in the authorization key

The report states that the contract used was TokenConversionManager V3, a legally-locked release component of the SingularityNET bridge on the Ethereum side, whose open source code is consistent with official repositories and linked to FET tokens from an existing AI superintelligence alliance.

The investigation determined that the source of the loss was a back-end authorization key leak, rather than an attacker circumventing contract logic. Attacking transactions with valid signatures from addresses trusted by contracts allowed the conversionIn function to release all FET balances in contracts to addresses under attackers' controls.

The contract design magnifies the losses: a single upper limit of 1 million FETs only constrains tokens flowing from Ethereum, but does not take effect in the conversionIn direction, so that an attacker simply diverts 8.72 million FETS. In addition, the signature message is not binding to the final recipient and valid authorization can direct the token to any address specified by the caller.

Associated evidence: dormant keys, early layout and asset liquidation

NuNet's anomalous activity provides the most direct evidence yet of a conspiracy. 29 minutes after FET was transferred, at 20:50 UTC, 408,532,878 NTX were released from a NuNet increment key that had been dormant since March 2023, all sent to the same wallet as the receiving FET, approximately equivalent in size to 42% of the supply recorded by NuNet.

Subsequent forensics have further tightened the link: 45 minutes before the FET was stolen (19:36 UTC), 0.3667 ETH had been transferred to a target's wallet, and 24.3 million NTX were transferred from an account associated with the attackers. The sale of NTX through MetaMask's exchange facility had already begun before the bridge was emptied, indicating that the entire operation had started earlier than the owner robbed it.

The attackers then began to manifest: the stolen FET was mostly exchanged for Ethereum via MetaMask's exchange facility, and more than 217 million new NTX tokens were sold through decentralized liquidity venues. As of September 20 at about 1:10 UTC, the core wallet held 547.89 ETH (approximately $1.44 million) and 230 million NTX token.

The liquidity of NTX quickly became a bottleneck: the next four sales, totaling 38.55 million units sold for only about 0.30 ETH, nearly exhausted the pool. Another 10 million were processed through Mayan Protocol cross-chain and ended up producing around 940 USDT.

Scope and follow-up: WMTX suspends charging, key rotates into a key

The impact subsequently expanded beyond the two assets under report focus analysis. Bitvavo suspended its fundraising and temporarily stopped trading on September 20 as WMTX was experiencing a security incident, while stating that customer assets were safe. Historical records show that both WMTx, FET, and NTX are associated with infrastructure in SingularityNET's Cardano bridge ecosystem, but available evidence only details the movements of FET versus NTX and does not demonstrate failure by the same mechanism at W MTX.

Fetch.ai said it was working with SingularityNET to maintain the exchange suspension during its investigation.

The first tracking window of the report shows that about five hours after the attack, the stolen FET bridge authorization key had not yet been rotated or revoked with NuNet's add-on keys, at which point the FET bridges were idled. This makes credential disposal central to recovery services: newly injected liquidity may be signed back into a replenishment contract if the authorizing key is still trusted; and as long as the problem wallet retains its add-ons rights, NuNet also runs the risk of continuing to be independent from NTX.

Therefore, Fetch.ai's AGIX swap FET service with the Ethereum side-bridge is the most direct indicator of whether it has been restored or not. As for WMTX, Bitvavo said that trading and transfers will continue to be restricted during the evaluation event, when the exchange reboots and keys are rotated, which will be the next visible signal to check if the relevant infrastructure is safe again.