Two AI-focused crypto projects were exploited by the same attacker on September 19, with combined losses of roughly $2 million, according to on-chain monitoring by Blockaid and PeckShield. The link between the two incidents is a wallet: the address that received the stolen funds from the first attack was then used to carry out the second.
How the Attack Unfolded
The attacker first drained about 8.7 million FET tokens, worth roughly $1.53 million, from a token converter contract belonging to Fetch.ai, CoinPedia and KuCoin News report, citing PeckShield's monitoring. According to Blockaid, the same wallet was then used to mint 408.5 million unauthorized NTX tokens — worth around $463,000 — through NuNet's deployer account. Blockaid published the exploiter's wallet addresses and an example transaction, allowing exchanges and other projects to flag further movement.
The attacker moved quickly to convert a large portion of the proceeds into 546 ETH, worth roughly $1.44 million at the time — a common laundering step that makes stolen assets harder to freeze.
The Root Cause: An Authorization Gap
SlowMist's technical analysis points to a specific defect on the Fetch.ai side: the affected converter contract, TokenConversionManagerV3, handles conversions involving the ERC-20 version of FET using signed authorization data. According to SlowMist, the conversionIn() function leaves a single-EOA ECDSA signature as the sole authorization check — it lacks the checkLimits(amount) modifier that is present in the paired conversionOut() function, and does not verify the authorization against sufficient on-chain state.
In plain terms: the function that moved tokens inbound trusted one signature where the rest of the contract demanded additional bound checks. The NuNet side of the incident — how the attacker reached the deployer account that minted the unauthorized NTX — has not been publicly detailed beyond the wallet linkage established by Blockaid.
Market Impact and Missing Statements
NuNet's NTX fell as much as 65–70% following the exploit, hitting all-time lows according to different trackers, while FET dropped around 10%. These are observed moves after the incident was flagged, not forward-looking claims; both tokens remained volatile as researchers continued tracing funds.
As of this report, neither Fetch.ai nor NuNet has released an official statement addressing the exploit. Security researchers tracking the incident are urging token holders in both ecosystems to wait for team confirmation before assuming the affected pathways are safe to use again.
The Pattern: One Credential, Multiple Protocols
The incident illustrates a recurring weakness in multi-contract architectures: access compromised at one point was reused at another. The same wallet — and, on the NuNet side, reportedly the same class of privileged access — carried both attacks. Projects building converter, bridge or minting infrastructure around privileged accounts face the same question this incident answers the expensive way: what exactly limits a single valid authorization, and where is that limit actually enforced on-chain?
Infrastructure compromises accounted for about 76% of the money stolen in crypto attacks in the first half of 2026 despite being only 15% of incidents, per TRM Labs data — and authorization reuse is among the cheapest of those failures to prevent.
TrustGrade tracks the security posture of protocols and infrastructure providers. Verified trust data: trustgrade.ai.