A single attacker used compromised off-chain signing and mint keys to drain 8.72M FET (~$1.55M) and mint 408.53M NTX, 260M AGIX and 53.838M WMTx across the Fetch.ai/SingularityNET/NuNet/World Mobile cluster, with ~$16.77M held by the attacker.
On September 19, 2026, a compromised off-chain signing key authorized a single conversionIn call on Fetch.ai's TokenConversionManagerV3 (0xab424A430CC09864fA1277A38193111705ADF3A3), draining 8,721,530.40 FET (~$1.55M) to 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE at 20:21:47 UTC (block 26,013,913). Twenty-nine minutes later, 408.53M NTX (~42% of supply) was minted via a NuNet minter key dormant since March 2023; then 260M AGIX and 53.838M WMTx were minted on Ethereum on September 20. PeckShield valued the cluster's holdings at ~$16.77M (198.3M AGIX ~$14.42M, 649 ETH ~$1.67M, 33.538M WMTx ~$627K), while Bitquery measured realized proceeds at ~$2.25M. The conversionIn function enforced no per-conversion limit and the signed digest did not bind the recipient. Both teams paused AGIX-to-FET conversions and the Ethereum bridge; as of reporting the compromised authorizer had not been rotated and the NuNet minter role had not been revoked.
Bitquery measured realized proceeds at only ~$2.25M of the ~$16.77M held, indicating the attacker had begun converting and moving assets. The compromised authorizer and NuNet minter role remained unrevoked as of reporting.