Fetch.ai and NuNet Lose $2 Million in Private Key Compromise

Coordinated Infrastructure Exploit Targets Fetch.ai and NuNet

An attacker compromised privileged signing credentials to breach infrastructure shared by Fetch.ai and NuNet, two projects within the broader Artificial Superintelligence Alliance ecosystem, extracting approximately $2.01 million in a coordinated exploit detected on September 19, 2026. Blockchain security firms PeckShield and Blockaid independently traced both incidents to the same attacker wallet cluster, revealing a cascade failure in operational security that spanned connected systems despite the underlying token contracts themselves remaining uncompromised.

According to PeckShield, the exploiter siphoned 8.7 million $FET valued at $1.53 million from a Fetch.ai converter contract, while simultaneously receiving an unauthorized mint of 408.5 million NTX tokens worth approximately $462,730 from the NuNet deployer account. Blockaid’s real-time monitoring confirmed approximately $1.56 million in $FET drained from the converter alongside roughly $452,000 in newly minted NTX, bringing the total observed value to $2.01 million while the attack was still ongoing. NuNet, described by CoinMarketCap as the second spin-off from SingularityNET, operates within the same AI-crypto ecosystem as Fetch.ai, amplifying the systemic implications of the shared credential compromise.

🚨Blockaid detected an ongoing exploit on @Fetch_ai on Ethereum.The same exploiter wallet then received a large NTX mint from the @nunet_global deployer account.~$2.01M so far (~$1.56M $FET drained from the converter + ~$452k NTX minted) across the cluster. Attack still…

— Blockaid (@blockaid_) September 19, 2026

Single Signature Authorization Failure Identified as Root Cause

SlowMist’s technical analysis pinpointed the structural vulnerability: the TokenConversionManagerV3 contract relied solely on an ECDSA signature from a single externally owned account to authorize the conversionIn() function that drained the $FET reserves. The contract lacked a checkLimits(amount) control mechanism and did not verify the presence of burn or lock proofs on-chain. This design meant that once the authorizer key was compromised, a legitimate signature alone was sufficient to empty the converter’s entire $FET balance without additional safeguards.

Fetch.ai’s preliminary analysis concluded that the signing key had likely been compromised, while on-chain evidence suggests the NuNet minting key may have suffered a similar breach. The projects responded collaboratively: Fetch.ai confirmed it worked with SingularityNET to deactivate affected wallets and contracts, stating that no Fetch.ai contracts remained at risk and that AGIX-to-$FET conversions had been paused as a precaution. An on-chain analysis tracing the attack from the compromised signing key to the attacker’s cash-out wallets has been published on ASI:One, though Fetch.ai emphasized this is not the final report.

An on-chain analysis of the exploit is now available on ASI:One. It traces the attack from the compromised signing key to the attacker’s cash-out wallets. This is not the final analysis.Read the report: https://t.co/W95r50VMaYTogether with @SingularityNET, we have deactivated…

— Fetch.ai (@Fetch_ai) September 20, 2026

Divergent Market Impacts Highlight Supply Dynamics

The two tokens exhibited starkly different price responses driven by the distinct mechanics of each exploit. The $FET hack removed previously issued tokens from circulation, while the NTX hack generated hundreds of millions of unauthorized tokens, fundamentally compromising supply integrity and creating intense selling pressure. CoinMarketCap data shows NTX trading around $0.000066, down nearly 95% within 24 hours after hitting an all-time low of $0.00004075 on September 20. In contrast, $FET avoided a comparable catastrophe because the attack reduced rather than inflated its circulating supply.

Why This Matters

While the $2 million direct loss appears modest against the estimated $2.85 trillion cryptocurrency market capitalization, the attack methodology aligns with a dominant and escalating industry threat vector. TRM Labs recorded 207 hacks totaling $972 million in losses during the first half of 2026, with infrastructure and operational compromises accounting for only 15% of incidents but approximately 76% of stolen funds. CoinGecko’s 2026 security report reinforces this pattern, documenting over $1.8 billion in losses from infrastructure and supply-chain breaches between January 2025 and July 2026, with private-key compromise persisting as a primary failure point. A parallel case emerged in June 2026 when Humanity Protocol disclosed that exposed private keys contributed to losses up to $31 million, sending its H token down as much as 90%. The Fetch.ai and NuNet incident underscores how weaknesses in key management can cascade across interconnected protocols, even when smart contracts themselves are not directly exploited.

Frequently Asked Questions

How did the attacker gain access to both Fetch.ai and NuNet systems?

Security firms linked both exploits to the same attacker wallet. Fetch.ai’s analysis indicates the signing key for the TokenConversionManagerV3 contract was compromised, allowing unauthorized conversionIn() calls. On-chain evidence suggests the NuNet minting key may have been similarly compromised, enabling the unauthorized NTX mint from the deployer account.

Why did NTX crash 95% while $FET remained stable?

The $FET exploit drained existing tokens from a converter contract, reducing circulating supply. The NTX exploit minted 408.5 million new unauthorized tokens, massively inflating supply and destroying tokenomics. This supply shock created overwhelming sell pressure that crashed NTX from ~$0.000066 to an all-time low of $0.00004075.

What steps have Fetch.ai and NuNet taken to contain the damage?

Fetch.ai deactivated affected wallets and contracts in coordination with SingularityNET, paused AGIX-to-$FET conversions as a precaution, and stated no Fetch.ai contracts remain at risk. An on-chain analysis is available on ASI:One tracing the attack flow. NuNet’s specific remediation steps for the unauthorized NTX supply have not been detailed in the current reports.