Single Wallet Links $1.55M FET Theft to 408.5M NTX Mint

An on-chain forensic report found that on Sept. 19 a single attacker-controlled wallet received 8,721,530 FET, roughly $1.55 million at the time, withdrawn from SingularityNET’s Ethereum conversion contract. Twenty-nine minutes later the same wallet received 408,532,878 NTX newly created by a compromised NuNet minter.

Investigators identified the affected contract as TokenConversionManagerV3, the Ethereum-side lock-and-release component used by SingularityNET’s bridge. The report traced the FET withdrawal to a compromised backend authorization key. The conversionIn transaction carried a valid signature from an address trusted by the contract, allowing the contract to release its full FET balance. The contract’s 1 million FET cap applied to tokens leaving Ethereum but was not enforced on conversionIn, and the signed authorization did not bind the recipient address.

The NuNet mint occurred at 20:50 UTC and involved a minter key that had been dormant since March 2023. The report calculated the mint as about 42% of NuNet’s documented token supply. Earlier on the same day, 45 minutes before the FET transfer, the NuNet minter moved 0.3667 ETH to the eventual receiving wallet and another attacker-linked account transferred 24.3 million NTX into it. NTX sales using MetaMask swap functions began before the bridge was emptied.

After the transfers, the wallet converted much of the stolen FET through MetaMask swaps into Ethereum and sold over 217 million NTX through decentralized liquidity venues. By about 01:10 UTC on Sept. 20 the central attacker wallet held 547.89 ETH (about $1.44 million at the time) and roughly 230 million NTX. Liquidity limits reduced later NTX proceeds: four sales totaling 38.55 million NTX increased the wallet’s ETH by only about 0.30 ETH. A separate 10 million NTX trade routed through Mayan Protocol returned about 940 USDT.

As a precaution, Fetch.ai paused AGIX-to-FET conversions and the Ethereum-side bridge; the company identified the affected infrastructure as belonging to SingularityNET and said Fetch.ai’s own contracts and routine FET transfers remained operational.

The report found that the compromised FET bridge authorizer and the NuNet minter credentials had not been rotated or revoked roughly five hours after the attack, leaving the conversion contract empty and inactive. Restoring services will depend on credential remediation because refilling the conversion contract while the same authorizer remains trusted could allow further signed withdrawals, and NuNet faces risk if the minter authority remains active.

Exchange Bitvavo suspended WMTX deposits and withdrawals on Sept. 20 and temporarily halted trading while it assessed an active security incident; the exchange reported that customer balances were safe. The forensic analysis focused on FET and NTX activity and did not establish that WMTX was compromised by the same mechanism.

Investigators recommended revoking or rotating the compromised authorizer and minter keys before any contract refills or exchange reopenings, and auditing bridge authorization logic to ensure transaction caps and recipient bindings are enforced across all contract functions.