Fetch.ai and NuNet Exploit Drains $2M as NTX Plunges 65%

Fetch.ai and NuNet were hit by linked security incidents that moved nearly $2 million in crypto assets, with the same attacker address tied to an 8.7 million FET withdrawal and the creation of 408.5 million NTX.

The FET, worth roughly $1.53 million during the incident, came from Fetch.ai’s Ethereum-based TokenConversionManagerV3 contract. The verified contract manages conversions involving the ERC-20 version of FET and uses signed authorization data for conversion transactions.

Security monitoring later connected the address receiving the FET to the NuNet activity. The combined value involved was approximately $2 million.

Fetch.ai Converter Loses 8.7 Million FET

The September 19 transactions removed approximately 8.7 million FET from the Fetch.ai conversion infrastructure. Blockaid’s analysis indicated that an externally owned account used valid conversion authorization data to interact with the converter, although the exact method used to obtain or generate that authorization has not been established publicly.

The contract includes checks for invalid or previously used signatures, transaction limits and a designated conversion authorizer. No confirmed technical explanation has yet established whether the incident resulted from compromised authorization credentials, an implementation issue or another failure outside the contract itself.