Fetch.ai and NuNet were hit by linked security incidents that moved nearly $2 million in crypto assets, with the same attacker address tied to an 8.7 million FET withdrawal and the creation o
Fetch.ai and NuNet were hit by linked security incidents that moved nearly $2 million in crypto assets, with the same attacker address tied to an 8.7 million FET withdrawal and the creation of 408.5 million NTX.
The FET, worth roughly $1.53 million during the incident, came from Fetch.ai’s Ethereum-based TokenConversionManagerV3 contract. The verified contract manages conversions involving the ERC-20 version of FET and uses signed authorization data for conversion transactions.
Security monitoring later connected the address receiving the FET to the NuNet activity. The combined value involved was approximately $2 million.
The September 19 transactions removed approximately 8.7 million FET from the Fetch.ai conversion infrastructure. Blockaid’s analysis indicated that an externally owned account used valid conversion authorization data to interact with the converter, although the exact method used to obtain or generate that authorization has not been established publicly.
The contract includes checks for invalid or previously used signatures, transaction limits and a designated conversion authorizer. No confirmed technical explanation has yet established whether the incident resulted from compromised authorization credentials, an implementation issue or another failure outside the contract itself.
The incident follows several recent attacks involving narrowly scoped smart-contract components. A Notional Finance escrow contract lost about $1.7 million earlier in September, while investigators had not established the precise authorization path behind that withdrawal at publication.
The same attacker was subsequently linked to approximately 408.5 million newly minted NTX originating through NuNet’s deployment infrastructure. The tokens were valued at roughly $462,700 at the time of the activity, based on the sharply reduced market price following the mint.
The supply expansion was followed by an approximately 65% collapse in NTX. CoinGecko recorded NTX closing September 18 near $0.00133 before falling to about $0.000469 on September 19.
Unauthorized supply creation has produced similar disruptions elsewhere this year. The Base deployment of The Sandbox was hit by a suspected SAND mint in August after an address obtained minting authority and created billions of tokens beyond the normal supply.
Recently, Blink Wallet temporarily shut down its platform after an attacker gained unauthorized access to a limited number of custodial accounts and withdrew funds, while FomoPeek, an iPhone app marketed for tracking whale wallets, contained malicious code capable of escaping iOS security restrictions and extracting cryptocurrency wallet credentials from affected devices.
The address linked to both incidents subsequently converted much of the extracted value into approximately 546.36 ETH, worth about $1.44 million when PeckShield traced the transactions.
Neither Fetch.ai nor NuNet had published a technical post-mortem or confirmed the underlying failure mechanism at the latest check. The available onchain evidence establishes the FET withdrawal, NTX issuance and subsequent asset conversions, but does not yet establish a common vulnerability across the two projects.
Fetch.ai’s affected TokenConversionManagerV3 contract remained active on Ethereum and held approximately 13.7 million FET at the latest Etherscan check.
The post Fetch.ai and NuNet Exploit Drains $2M as NTX Plunges 65% appeared first on Crypto Adventure.
