Attacker Targets Fetch.ai, NuNet and SingularityNET Infrastructure in 2.3 Billion-Token Exploit

An attacker targeted infrastructure linked to Fetch.ai, NuNet and SingularityNET, minting or draining approximately 2.3 billion tokens across five assets and accumulating about $17 million in unrealized profits, according to Coin Bureau, citing blockchain security firm PeckShield.

The activity involved 8.7 million FET drained from Fetch.ai, alongside the unauthorized creation of hundreds of millions of NTX, AGIX, WMTX and CGV tokens. Blockchain intelligence firm Bitquery separately traced an initial movement of ETH and BNB from 16 wallets before the token activity began.

Five Assets Targeted in the Attack

The transactions affected five different assets, with the attacker using project infrastructure to create new tokens or remove existing tokens from contracts.

According to the figures shared by Coin Bureau, the attacker drained 8.7 million FET, minted 408.5 million NTX, created 896 million AGIX, minted 500.5 million WMTX and generated 492.4 million CGV.

Bitquery’s on-chain investigation markets also identified the activity as involving tokens associated with the Artificial Superintelligence ecosystem. Its analysis found that the tokens were issued using the projects’ own privileged infrastructure rather than representing ordinary market issuance.

The scale of the unauthorized issuance explains the large difference between the nominal value of the tokens and the amount that could actually be converted into other assets. Bitquery reported that the attacker’s main realized cash event came from selling 8.7 million FET, while much of the newly created token supply had limited liquidity.

Attacker Cashed Out About $2.25 Million

Despite the reported $17 million in unrealized profits, the amount actually converted into other assets was substantially lower.

Coin Bureau reported that the attacker cashed out approximately $2.25 million, with most of the proceeds coming from the FET sale. Bitquery similarly identified the FET transaction as the principal realized cash event and traced the sale into ETH.

PeckShield’s reported $17 million figure therefore reflects the estimated value of assets held by the attacker, including tokens that were newly minted but had not necessarily been sold. A separate report citing PeckShield placed the attacker’s holdings at approximately $16.77 million at one point during the incident.

The distinction is important because the nominal value of unauthorized tokens does not necessarily represent an equivalent amount of realized losses or proceeds.

Bitquery Traced Activity Across 16 Wallets

Bitquery also identified an initial sweep of ETH and BNB from 16 wallets before the unauthorized token activity. The blockchain intelligence firm linked the transactions to the broader attack cluster and identified movements involving the infrastructure associated with the affected projects.

The incident subsequently expanded beyond the initial FET drain and NTX minting activity, with AGIX, WMTX and CGV also appearing in the unauthorized issuance traced by blockchain analysts.

The investigation remains focused on the compromised infrastructure and the movement of the resulting assets. The reported figures show that the financial attack involved both the removal of existing tokens and the creation of large amounts of new supply, while the approximately $2.25 million in realized proceeds represents a much smaller amount than the estimated unrealized holdings.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.