Hacker Steals $2 Million From Fetch.ai, NuNet In Single Attack

Security firms Blockaid and PeckShield say the same attacker hit two separate AI-focused crypto projects on September 19, walking away with close to $2 million combined.

How The Attack Unfolded

The attacker first drained about 8.7 million $FET tokens, worth roughly $1.53 million, from a token converter contract belonging to Fetch.ai. According to Blockaid, the same wallet that received those stolen funds was then used to mint 408.5 million unauthorized NTX tokens, worth around $463,000, directly through NuNet’s deployer account. That shared wallet is what links both attacks to a single actor.

Blockaid published the exploiter’s wallet addresses publicly, along with an example transaction, allowing other projects and exchanges to flag and block further movement from those addresses.

Token Prices Take A Hit

NuNet’s NTX token crashed as much as 65-70% following the exploit, according to different trackers, while $FET dropped around 10%. The attacker moved quickly to convert a large portion of the stolen funds into 546 ETH, worth roughly $1.44 million, a common tactic used to make stolen crypto harder to trace or freeze.

No Official Response Yet

As of this report, neither Fetch.ai nor NuNet has released an official statement addressing the exploit. Security researchers tracking the incident are urging anyone holding or actively using tokens from either ecosystem to stay cautious until the teams confirm what happened and whether their platforms are safe to use again.

Why This Matters

The incident shows a recurring weak point across AI and compute-focused crypto projects. Smart contract permission structures that, if misconfigured or exploited, can allow an attacker to drain funds from one contract and mint unauthorized tokens on an entirely separate, unrelated project using the same stolen access.