Security firms linked the Fetch.ai exploit to an attack on NuNet on September 19, involving about $2 million in assets. PeckShield reported that roughly 8.7 million FET tokens, valued at approximately $1.53 million, left a Fetch.ai token converter. NuNet’s deployer account also minted 408.5 million NTX tokens without authorization, worth about $462,730. Blockaid estimated the FET portion at $1.56 million and the NTX mint at $452,000, bringing the total near $2.01 million. The attacker exchanged drained assets for 546.36 ETH, approximately $1.44 million. The price of NTX later fell more than 90%, while FET recorded a smaller decline amid a broader market sell-off.
The Fetch.ai exploit and NuNet token mint were linked by the same receiving wallet, 0x1572…c362, according to Blockaid. PeckShield reported the proceeds were swapped for 546.36 ETH, valued at roughly $1.44 million at the time.
SlowMist identified the root cause in Fetch.ai’s TokenConversionManagerV3 contract on Ethereum. The attack exploited the conversionIn() function, which relied on a single ECDSA signature from one external account and lacked the checkLimits(amount) modifier present in the outbound function. Reports did not explain how the attacker obtained a valid signature or accessed NuNet’s deployer.
NTX hit an all-time low of $0.00005338, with a 24-hour decline exceeding 90% as of September 20. FET’s decline occurred alongside a general market sell-off that saw total cryptocurrency market capitalization fall by 4.1%.
The incident adds to a series of security losses in September. DefiLlama listed 17 security incidents for the month, with total losses reaching roughly $331 million, according to data on September 17. A single bridge attack on Liquid Network on September 6 accounted for about $320 million, representing nearly 97% of those losses.
Nostra Money Market lost approximately $3.5 million on September 17 due to oracle manipulation. Nomic’s entry on September 9 showed $3.15 million in losses from an unbacked cross-chain mint. Chainflip reported $736,442 in losses on September 12 from a logic flaw in its bridge. Including the new estimates from the Fetch.ai and NuNet incidents, total recorded losses for September amount to roughly $333 million.
