An attacker drained SingularityNET’s cross-chain bridge of 8.72 million FET, worth roughly $1.55 million, at 20:21 UTC on 19 September, using a stolen backend signature key to forge legitimate withdrawal approvals through the bridge’s conversionIn function. Twenty-eight minutes later the same wallet cluster used a second compromised key to mint 408.5 million NTX on NuNet, about 42 percent of that token’s entire supply. The following day it minted a further 260 million AGIX and 53.8 million WMTx on Ethereum. Security firm PeckShield puts the cluster’s total holdings at approximately $16.77 million, a figure it describes as preliminary pending reconciliation against on-chain contract states.
AGIX fell more than 99 percent within a day, wiping out roughly $93 million of the token’s market capitalisation before trading partially recovered. Fetch.ai moved quickly to separate itself from the damage, confirming its own FET contracts were untouched and that the breach struck a bridge route tied to SingularityNET’s infrastructure rather than its core protocol. The two projects, with NuNet as an ecosystem partner, jointly deactivated the affected wallets and contracts once the pattern was clear.
SingularityNET, Fetch.ai and Ocean Protocol merged their tokens into the Artificial Superintelligence Alliance in 2024, and NuNet builds on the same agent frameworks. That shared plumbing is what let one attacker move from bridge to minting key to a second chain inside thirty minutes, a reminder that consolidating an ecosystem’s infrastructure consolidates its attack surface too.
Neither project has said how the backend signature keys were obtained in the first place, nor whether the $16.77 million figure will grow again as investigators reconcile the remaining wallets. The pattern so far, a fast-widening loss total reported in stages over 24 hours, is the part still worth watching.
