A coordinated attack on September 19 compromised authorization credentials to drain 8.7 million FET tokens worth approximately $1.55 million from SingularityNET's Ethereum-Cardano bridge and generate 408.5 million newly minted NTX tokens, according to on-chain forensic analysis by Athena.
The FET withdrawal occurred first, emptying the TokenConversionManagerV3 contract on Ethereum. Twenty-nine minutes later, a dormant NuNet minter key that had been inactive since March 2023 created 408,532,878 NTX tokens—equivalent to roughly 42% of NuNet's documented token supply—and transferred the entire amount to the same wallet that received the stolen FET.
Attack Mechanics and Design Flaws
Forensic investigators determined the breach resulted from a compromised backend authorization key rather than a smart contract vulnerability. The attacker's transaction carried a valid signature from an address the bridge contract was configured to trust, allowing the conversionIn function to release the entire FET balance in a single withdrawal.
The contract's design amplified the damage. Although a 1 million FET transaction cap existed for tokens moving out of Ethereum, it was not enforced on the conversionIn function, permitting the 8.72 million FET withdrawal. Additionally, the signed message did not bind the recipient address, enabling the attacker to direct tokens to any wallet of their choosing.
Evidence of Coordination
The involvement of both the FET bridge and NuNet minter keys pointed to a broader coordinated operation. Forty-five minutes before the FET drain, the NuNet minter transferred 0.3667 ETH directly to the eventual receiving wallet, while another attacker-linked account moved 24.3 million NTX into it. NTX sales through MetaMask's swap infrastructure had already begun before the main FET withdrawal.
Asset Conversion and Liquidity Constraints
The attacker routed stolen FET through MetaMask's swap infrastructure and exchanged it largely for Ethereum. More than 217 million of the newly minted NTX was sold through decentralized liquidity venues. By approximately 1:10 UTC on September 20, the central wallet held 547.89 ETH worth roughly $1.44 million and another 230 million NTX.
Liquidity constraints quickly limited NTX sales. Four subsequent sales involving 38.55 million NTX increased the attacker's ETH balance by only approximately 0.30 ETH as available pools became depleted. A separate 10 million NTX transaction routed through Mayan Protocol generated approximately 940 USDT.
Response and Ongoing Risks
Fetch.ai paused AGIX-to-FET conversions and its Ethereum-side bridge contract as a precaution. The company confirmed that affected infrastructure belonged to SingularityNET while Fetch.ai's own contracts and normal FET transfers remained operational.
The compromised authorization credentials had not been rotated or revoked approximately five hours after the attack, according to the forensic report. Credential remediation is central to restoring affected services, as refilling the FET conversion contract while the same authorizer remains trusted could expose fresh liquidity to additional signed withdrawals.
Bitvavo temporarily suspended deposits, withdrawals, and trading for WMTX on September 20 citing an active security incident affecting the token, though the exchange confirmed customer balances remained safe. Historical SingularityNET documentation shows WMTX, FET, and NTX all used infrastructure connected to the Ethereum-Cardano bridge ecosystem, though forensic evidence examined FET and NTX activity in detail without establishing that WMTX was compromised through the same mechanism.
