Forensic report links $1.55 million FET theft to 408.5 million NTX mint

A coordinated attack drained 8,721,530 FET worth about $1.55 million from the Ethereum-side conversion contract used by SingularityNET's bridge on Sept. 19. Twenty-nine minutes later, a compromised NuNet minter key created 408,532,878 NTX and sent the tokens to the same receiving wallet, according to an on-chain forensic report prepared by Athena. Investigators said the compromised bridge authorizer and NuNet minter credentials had not been rotated during the initial tracking window. Fetch.ai subsequently paused AGIX-to-FET conversions and its Ethereum-side bridge as a precaution. Fetch.ai said the affected infrastructure belonged to SingularityNET, primarily its Ethereum-Cardano bridge, while Fetch.ai's own contracts and normal FET transfers remained operational. The report identified the affected bridge contract as TokenConversionManagerV3, a legitimate Ethereum-side lock-and-release component tied to the current Artificial Superintelligence Alliance FET token. Investigators attributed the loss to a compromised backend authorization key rather than to a flaw that allowed an attacker to bypass the bridge contract. The transaction carried a valid signature from the trusted address configured in the contract, allowing the entire FET balance to be released to an attacker-controlled wallet. The contract had a 1 million FET transaction cap for tokens moving out of Ethereum, but the attacker withdrew 8.72 million FET in one transaction. The signed message also did not bind the eventual recipient, allowing the caller to select the destination address. At 20:50 UTC, the dormant NuNet minter key created 408,532,878 NTX and sent the full amount to the wallet that received the stolen FET. The report said the mint equaled roughly 42% of NuNet's documented token supply. A later forensic pass said the NuNet minter sent 0.3667 ETH directly to the eventual receiving wallet at 19:36 UTC, while another attacker-linked account moved 24.3 million NTX into that wallet. NTX sales through MetaMask's swap infrastructure had begun before the FET bridge was emptied. The stolen FET was then exchanged largely for Ethereum through MetaMask's swap infrastructure, while more than 217 million newly minted NTX was sold through decentralized liquidity venues. By about 1:10 UTC on Sept. 20, the central wallet held 547.89 ETH worth roughly $1.44 million and another 230 million NTX, according to the report. Four later sales involving 38.55 million NTX increased the attacker's ETH balance by only about 0.30 ETH as available liquidity pools were depleted. A separate 10 million NTX transaction routed through Mayan Protocol produced about 940 USDT for cross-chain dispatch. Bitvavo suspended WMTX deposits and withdrawals on Sept. 20 after citing an active security incident affecting the token, then temporarily halted trading. The exchange said customer balances remained safe. Historical SingularityNET material connects WMTX, FET and NTX to its Ethereum-Cardano bridge ecosystem, but the available forensic evidence examined the FET and NTX activity in detail and did not establish that WMTX was compromised through the same mechanism. Fetch.ai said it was working with SingularityNET and paused conversions while investigating. The report's first tracking window found that the compromised FET bridge authorizer and NuNet minter credentials had not been rotated or revoked roughly five hours after the attack. The report said restoring the affected services would depend on credential remediation because refilling the FET conversion contract while its authorizer remained trusted could expose new liquidity to another signed withdrawal. It also said NuNet faced a separate risk while the affected wallet retained authority to create additional NTX. Fetch.ai's conversion service and Ethereum-side bridge remained operational markers to monitor, while Bitvavo said WMTX trading and transfers would remain restricted during its assessment.