Attackers drain $2M across Fetch.ai, NuNet, SingularityNET in coordinated bridge exploit

A single attacker exploited bridges on three interconnected AI-crypto projects over a weekend, stealing 8.7 million FET tokens and minting hundreds of millions of counterfeit tokens across four additional projects, according to Protos' reporting. The exploit signals that the attacker held signing infrastructure keys across the Artificial Superintelligence Alliance ecosystem, a unified platform linking Fetch.ai, NuNet, SingularityNET, World Mobile Chain, and Cogito.

The attacker realized approximately $2.25 million in profits by selling stolen FET tokens for 523 ETH (roughly $1.2 million) and liquidating other minted tokens for an additional 183 ETH ($420,000), per Protos. Security firm Peckshield estimated unrealized profits at almost $17 million, with the attacker currently holding 198.3 million AGIX tokens (valued at $14.42 million) and 649 ETH ($1.67 million) as of the reporting date.

The bridge compromises spanned five projects. Fetch.ai lost 8.7 million FET tokens. NuNet was exploited to mint 400 million NTX tokens. SingularityNET's systems were used to mint 900 million AGIX tokens. World Mobile Chain and Cogito had 500 million WMTx and 500 million CGV tokens minted respectively, though the CGV tokens generated only $30 in realized value due to extremely thin liquidity. In a secondary sweep, Protos reports the attacker drained $289,575 in USDC from a payroll contract.

Analytics firm Bitquery flagged a preliminary pattern: the attacker swept ETH and BNB from 16 wallets, four of which Bitquery had previously labeled as SingularityNET or NuNet staff wallets. This pattern suggests the attacker either compromised staff credentials or gained access to keys stored on systems those staff members used. The sale of 8.7 million FET tokens caused a 5% price drop in genuine FET, signaling cascading confidence loss across the ecosystem as massive volumes of counterfeit tokens flooded into circulation.

Protos reports that the majority of signing keys have not been changed since the exploits. This detail carries material risk: if the attacker retains access to the infrastructure that controls token minting across the alliance, the attack surface remains open. Neither Fetch.ai, NuNet, nor SingularityNET have disclosed, according to Protos' reporting, the vector by which the attacker obtained access to the keys in the first place, nor have they detailed recovery or remediation steps taken since discovery.

The dollar loss, while significant, is secondary to the structural breach. The attacker's ability to mint tokens across five separate projects within hours points to either a shared vulnerability in the bridge architecture or a single compromised authority whose keys controlled signing across all three platforms. The open question is whether this represents a flaw in how these projects stored and protected infrastructure credentials, or whether one of the projects served as the initial breach point through which all others were subsequently compromised.