Fetch.ai, NuNet, and SingularityNET faced a series of cyber attacks linked to a single hacker, resulting in unauthorized withdrawals and token minting.
Fetch.ai, NuNet, and SingularityNET have recently fallen victim to a coordinated series of cyber attacks attributed to a single hacker. This individual managed to withdraw FET tokens and issue hundreds of millions of tokens across various projects, as reported by PeckShield.
Details of the Initial Attack
The attacks began on the evening of September 19, when the hacker withdrew 8.7 million FET from Fetch.ai's conversion contract, valued at around $1.53 million. Shortly thereafter, the same addresses received 408.5 million newly minted NTX tokens, created through a NuNet account.
Experts believe that the hacker exploited a valid signature from an authorized address, allowing them to withdraw FET without proper asset verification. This loophole permitted access to the entire balance of the converter in one transaction. In the process, around 408 million NTX tokens were issued, raising the total supply from approximately 591 million to the maximum limit of 1 billion.
During the initial stages of the attack, the hacker converted assets worth about 546.36 ETH (approximately $1.44 million).
Continued Exploits on SingularityNET
On September 20, further attacks were reported, with the unauthorized issuance of 260 million AGIX and 53.8 million WMTx through the SingularityNET infrastructure on Ethereum. Analysts estimated the assets linked to the hacker's addresses to be around $16.77 million, which included 198.3 million AGIX, 649 ETH, and 33.5 million WMTx.
World Mobile confirmed the unauthorized issuance of WMTx and began reaching out to exchanges to suspend deposits while revoking the rights for creating new tokens. Notably, the Cardano network and World Mobile's infrastructure remained unscathed.
Subsequent reports revealed that the hacker had issued approximately 896 million AGIX, 500.5 million WMTx, and additional tokens, bringing the total number of affected tokens to around 2.3 billion, although the actual realized assets were estimated at about $2.25 million due to liquidity constraints.
Investigation and Response from Developers
In response to the attack, teams from Fetch.ai and SingularityNET quickly disabled the impacted wallets and contracts. Fetch.ai confirmed that their core contracts were not compromised and that operations would continue as normal. They also halted the conversion of AGIX to FET and suspended the Ethereum bridge as a precautionary measure.
World Mobile has urged users to refrain from interacting with WMTx while they prepare a snapshot of the network's state prior to the incident. It is noteworthy that in 2024, SingularityNET, Fetch.ai, and Ocean Protocol had previously agreed to merge their tokens as part of the Artificial Superintelligence Alliance.
