A Coordinated Exploit Targets SingularityNET Bridge and Ecosystem Tokens
A sophisticated cyberattack recently targeted the SingularityNET ecosystem, resulting in the theft of approximately $1.55 million in FET tokens and the unauthorized minting of over 408 million NTX tokens. By leveraging compromised backend authorization keys rather than flaws in the smart contract code itself, the attackers managed to drain significant liquidity from the project’s Ethereum-side bridge infrastructure.
The Mechanics of the Breach
The attack centered on the TokenConversionManagerV3 contract, a key component of SingularityNET’s Ethereum-Cardano bridge. Forensic investigations revealed that the breach was not caused by a vulnerability in the contract’s verified source code, but rather by the theft of a backend authorization key. This allowed the attacker to present a valid signature to the contract, which then authorized the release of 8.7 million FET tokens to an attacker-controlled wallet. The damage was further amplified by a design oversight: while a 1-million-token cap existed for standard outgoing transfers, it was not enforced on the "conversionIn" function, allowing the attacker to bypass the limit in a single transaction.
Coordinated Asset Drain and Market Impact
The operation extended beyond FET, as the same attacker wallet was linked to the unauthorized creation of 408.5 million NTX tokens using a compromised NuNet minter key that had been dormant since 2023. This mint represented roughly 42% of NuNet’s total documented supply. Shortly after the tokens were acquired, the attacker began aggressive liquidation through decentralized venues and swap infrastructure, converting the stolen assets primarily into Ethereum. The incident also triggered secondary disruptions, with the Bitvavo exchange suspending trading for WMTX due to its connection to the same bridge ecosystem, highlighting the interconnected risks within the alliance.
Response and Remediation Efforts
In response to the exploit, Fetch.ai immediately paused its Ethereum-side bridge and AGIX-to-FET conversion services as a precautionary measure. While Fetch.ai’s internal contracts remained operational, the affected SingularityNET infrastructure requires urgent credential remediation. Security experts emphasize that refilling the bridge or restarting services without rotating the compromised authorization keys would expose fresh liquidity to the same exploit. The focus now remains on revoking the attacker’s authority and securing the bridge ecosystem before normal operations can safely resume.
