Fetch.ai, Nunet Hit by $2.01M Exploit as Attacker Inflates NTX Supply 42%

A single attacker executed a $2.01 million crypto heist on September 19, simultaneously targeting Fetch.ai and Nunet by compromising backend signing keys tied to both protocols' core functions.

On the Fetch.ai side, 8,721,530 FET tokens—valued at roughly $1.55 million at the time—were drained from a token converter linked to SingularityNET's cross-chain bridge. The attacker exploited the TokenConversionManagerV3 contract's `conversionIn` function, which accepted a valid conversion-authorizer signature without verifying that corresponding tokens had been locked or burned elsewhere. A single transaction was sufficient to deplete the converter's remaining FET inventory once the signing key was compromised.

Simultaneously, the attacker targeted Nunet, minting approximately 408.5 million new NTX tokens valued between $452,000 and $463,000 at the time. This minting event represented about 42 percent of NTX's total supply—a drastic dilution that sent the exchange rate into free fall. NTX plummeted from near $0.0013 to lows of $0.000328, with some trackers recording declines of 96 to 99 percent as liquidity evaporated.

Fetch.ai confirmed that both attack paths began in the same minute, with a separate NTX minting key also compromised. Security firms Peckshield and Blockaid, along with Fetch.ai, connected the activity to the same wallet cluster.

The vulnerability here is fundamental: the FET theft exploited a compromised gatekeeper signature rather than any mathematical flaw in the protocol. Once the signing key was compromised, the attacker could create valid messages pointing to their own address. The Nunet side proved even more destructive to token economics—instead of draining existing assets, the attacker gained the ability to create new supply outright, effectively halving the token's value through pure inflation.

This incident underscores why centralized key management remains a critical chokepoint in bridge infrastructure and multi-chain protocols. The method by which these keys were initially compromised remains under investigation.