Key Highlights
- Security firms Blockaid and PeckShield confirm a single attacker exploited both Fetch.ai and NuNet on September 19, stealing a combined total of nearly $2 million.
- The exploiter drained 8.7 million FET tokens ($1.53 million) from a Fetch.ai converter contract, then used the same wallet to mint 408.5 million unauthorized NTX tokens ($463,000) via NuNet’s deployer account.
- NuNet’s NTX token plummeted 65–70% while FET fell roughly 10%; the attacker quickly converted most proceeds into 546 ETH (~$1.44 million) to obscure the trail.
Coordinated Exploit Hits Two AI-Crypto Projects Within Hours
Blockchain security firms Blockaid and PeckShield have identified a single threat actor responsible for back-to-back exploits targeting Fetch.ai and NuNet on September 19. The combined haul approaches $2 million, underscoring a recurring vulnerability in the permission structures of AI- and compute-focused crypto protocols. Researchers say the same wallet address received funds from both incidents, providing a clear on-chain link between the two attacks.
Fetch.ai Converter Contract Drained First
The attack sequence began with the exploitation of a token converter contract belonging to Fetch.ai. According to Blockaid’s analysis, the attacker siphoned approximately 8.7 million FET tokens, valued at roughly $1.53 million at the time. The stolen assets were transferred to a wallet that would later serve as the bridge to the second exploit.
Same Wallet Used to Mint Unauthorized NuNet Tokens
Using the identical wallet that received the FET proceeds, the exploiter then interacted with NuNet’s deployer account to mint 408.5 million NTX tokens without authorization, netting an additional $463,000. Blockaid has published the exploiter’s wallet addresses and a sample transaction, enabling exchanges, bridge operators, and other projects to flag and block further movement from those addresses.
Market Reaction and Attacker Obfuscation
The market impact was immediate and asymmetric. NuNet’s NTX token crashed between 65% and 70% across various trackers, while Fetch.ai’s FET token declined approximately 10%. The attacker moved swiftly to launder proceeds, converting a large portion of the stolen funds into 546 ETH (roughly $1.44 million)—a standard tactic to complicate tracing and reduce the risk of asset freezes by centralized platforms.
No Official Statements; Researchers Urge Caution
As of publication, neither Fetch.ai nor NuNet has issued an official statement addressing the exploits or confirming the status of their smart contracts. Security researchers monitoring the incident are advising all holders and active users of FET and NTX tokens to exercise caution until the development teams provide clarity on the root cause and whether their platforms are safe to resume normal operations.
Why This Matters
The dual exploit highlights a systemic weak point across AI- and compute-oriented crypto projects: misconfigured or overly permissive smart contract access controls. In this case, a single compromised key or permission set allowed the attacker to drain liquidity from one protocol and leverage the same credentials to mint unauthorized supply on a completely separate, unrelated protocol. The incident reinforces the need for stricter role separation, multi-signature governance for deployer accounts, and continuous permission auditing—especially for projects that share infrastructure patterns or developer tooling across the AI-crypto intersection.
Frequently Asked Questions
Which projects were exploited and how much was stolen?
Fetch.ai lost approximately 8.7 million FET tokens ($1.53 million) from a converter contract, and NuNet had 408.5 million NTX tokens ($463,000) minted without authorization via its deployer account. The combined value is nearly $2 million.
How do we know the same attacker hit both projects?
Blockaid and PeckShield traced the on-chain flow and found that the wallet receiving the stolen FET tokens was the exact same wallet used to execute the unauthorized NTX mint on NuNet. Blockaid has published the wallet addresses and a sample transaction as evidence.
Have Fetch.ai or NuNet responded officially?
As of this report, neither project has released an official statement. Security researchers recommend token holders and users remain cautious until the teams confirm the root cause and platform safety.
