Attacker Targets Fetch.ai, NuNet and SingularityNET Infrastructure, Moving 2.3 Billion Tokens

An attacker targeted infrastructure linked to Fetch.ai, NuNet and SingularityNET, minting or draining approximately 2.3 billion tokens across five assets, according to Coin Bureau.

The attacker’s unrealized profits have reached $17 million, per blockchain security firm PeckShield, while approximately $2.25 million has already been cashed out, with most of the realized proceeds coming from the sale of FET tokens.

Five Assets Targeted in the Attack

Coin Bureau reported that the incident affected five different assets associated with the targeted infrastructure.

According to the figures shared in the X post, the attacker drained 8.7 million FET and minted 408.5 million NTX. The attacker also minted 896 million AGIX, 500.5 million WMTX and 492.4 million CGV.

The combined figures amount to more than 2.3 billion tokens that were either drained or newly minted through the targeted infrastructure.

The incident involves multiple token ecosystems and infrastructure connected with projects that have been associated with Fetch.ai, NuNet and SingularityNET.

$17 Million in Unrealized Profits

PeckShield, which was cited by Coin Bureau, estimated the attacker's unrealized profits at $17 million.

That figure represents the estimated value of the attacker's holdings or positions that had not yet been converted into realized proceeds at the time of the report. It is therefore distinct from the amount already cashed out.

Coin Bureau reported that the attacker had realized markets approximately $2.25 million, with the majority of that amount coming from the sale of FET.

The difference between the reported unrealized profits and realized cash-out amount reflects the distinction between assets still held by the attacker and funds that have already been converted or moved.

USDC Payroll Contract Also Drained

The reported activity was not limited to the five tokens.

Coin Bureau said the attacker also drained $289,575 from a USDC payroll contract.

The additional loss indicates that the targeted infrastructure included a contract holding funds denominated in USD Coin, alongside the token-related activity.

The figures shared in the report provide a breakdown of the assets involved but do not, by themselves, establish the full technical method used to compromise each component.

Security Questions Around Token Infrastructure

The incident highlights the security risks that can arise when blockchain projects rely on interconnected smart contracts, token infrastructure and other on-chain systems.

In this case, the reported activity involved both unauthorized token creation and the draining of existing assets. Those mechanisms can have different technical causes and may require separate investigations to determine how the attacker obtained the ability to mint or transfer assets.

For affected projects and token holders, identifying the compromised infrastructure and understanding the scope of the incident are key parts of determining the ultimate impact.

The figures currently cited by Coin Bureau and PeckShield provide a snapshot of the reported activity: 8.7 million FET drained, hundreds of millions of tokens minted across NTX, AGIX, WMTX and CGV, and $289,575 removed from a USDC payroll contract.

The attacker has so far cashed out approximately $2.25 million, while PeckShield's reported estimate places unrealized profits at $17 million.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.