Security firms Blockaid and PeckShield have identified a coordinated attack on two AI-focused crypto projects on September 19. The same attacker drained close to $2 million combined from Fetch.ai and NuNet, according to the security researchers tracking the incident.
Attack Details
The attacker first extracted approximately 8.7 million FET tokens, valued at roughly $1.53 million, from a token converter contract operated by Fetch.ai. The same wallet that received the stolen FET tokens was then used to mint 408.5 million unauthorized NTX tokens, worth around $463,000, directly through NuNet's deployer account. This shared wallet connection led security researchers to attribute both attacks to a single actor.
Blockaid published the exploiter's wallet addresses and sample transactions publicly, enabling other projects and exchanges to identify and block further movement of the stolen funds.
Market Impact
Following the exploit, NuNet's NTX token dropped as much as 65-70% in value across different tracking platforms, while Fetch.ai's FET token declined approximately 10%. The attacker rapidly converted a significant portion of the stolen funds into 546 ETH, equivalent to roughly $1.44 million, a strategy commonly used to obscure the origin of stolen cryptocurrency.
Response and Next Steps
As of the report, neither Fetch.ai nor NuNet has released an official statement addressing the exploit. Security researchers are advising users holding or actively using tokens from either ecosystem to exercise caution until the affected teams provide clarity on what occurred and confirm the safety of their platforms.
The incident highlights a recurring vulnerability in AI and compute-focused cryptocurrency projects, where misconfigured or exploited smart contract permissions can enable attackers to drain funds from one contract and create unauthorized tokens across separate, unrelated projects using the same compromised access.
