Blockchain security firms Blockaid and PeckShield stated that on September 19, the same attacker targeted two AI-related crypto projects: Fetch.ai and NuNet. Combined, the two incidents involved approximately $2 million in funds at the time of the attacks, after which the prices of the related tokens declined significantly.
FET has been transferred from the Fetch.ai contract.
According to Blockaid’s disclosure, the attacker first transferred approximately 8.7 million FET tokens, valued at around $1.53 million, from a token swap contract on Fetch.ai. Security researchers noted that the wallet address receiving these funds later appeared in the NuNet incident, which is the primary evidence linking both attacks to the same actor.
Blockaid also publicly disclosed the wallet addresses used by the attackers, along with an example transaction, to help other projects and exchanges identify and intercept related fund movements.
NuNet experienced an abnormal minting of 408.5 million NTX.
In the second incident, the attacker minted approximately 408.5 million unauthorized NTX tokens through NuNet’s deployer account, valued at around $463,000 based on the price cited in the report. Security researchers noted that this anomalous minting was sent to the same wallet as the stolen FET funds, linking both incidents to the same attacker.
Such incidents typically indicate gaps in contract permission controls or key account management. Once deployment permissions or contract upgrades are exploited, attackers can not only transfer existing assets but also directly create new token supplies.
The destination of 546 ETH is under close attention.
After the incident, the attacker quickly converted a significant portion of the funds into 546 ETH, worth approximately $1.44 million. Security researchers noted that this practice is common following attacks, as it increases the difficulty of tracking and freezing the funds.
Affected by the news, NuNet’s NTX dropped approximately 65% to 70%, while Fetch.ai’s FET fell by about 10%. As of the time of this report, neither Fetch.ai nor NuNet has issued an official statement regarding the incident.
- FET transferred: approximately 8.7 million
- Unauthorized minted NTX: approximately 408.5 million
- Attacker received: 546 ETH
Additional information: The report notes that security agencies believe this incident highlights a common risk in AI and computing-related crypto projects regarding contract permission management—specifically, if the deployer account or token conversion contract is compromised, it could trigger cascading losses across multiple projects.