One Wallet Drains Fetch.ai and NuNet for About $2 Million

A single wallet took about $2 million from two decentralized-AI projects, emptying a Fetch.ai bridge contract on Ethereum and minting itself 408.5 million NuNet tokens. Blockaid and SlowMist traced both legs to the same address, 0x1572…c362. SlowMist set out the root cause in an alert timed 05:26 UTC on Sunday: a converter function that treated one signature as its entire authorization check. Neither project had commented publicly when the first accounts were filed.

What the contract did not check

The contract is Fetch.ai's TokenConversionManagerV3, the code that moves FET tokens between Ethereum and the project's own ledger. Its conversionIn function took an ECDSA signature from a single externally owned account and asked for nothing more. Its outbound twin, conversionOut, carries a size limit that the inbound side does not. The inbound side also never confirmed that the tokens being claimed had been locked or burned anywhere.

"TokenConversionManagerV3's conversionIn() leaves single-EOA ECDSA signature as the sole authorization check," SlowMist said in its alert.

Anyone holding the authorizer's private key could sign a message naming their own address. SlowMist says that is what happened, and the converter's remaining FET inventory left in one transaction. AMBCrypto describes the same flaw without the jargon: the system accepted an approval without checking that the approved tokens had ever been locked or burned.

Two legs, several totals

How much left depends on the account. BeInCrypto and The Cryptonomist put the Fetch.ai leg at $1.56 million. AMBCrypto, the only account giving a token count, says 8.72 million FET worth about $1.54 million, and TronWeekly writes the span as $1.53m to $1.56m without resolving it. The coin figure is agreed and the dollar figures are not. The NuNet leg has the same problem. Two accounts put the unauthorized mint at 408.5 million NTX, sent from the project's own deployer account, and value it at about $452,000 on two readings against about $463,000 on a third. PeckShield says the proceeds were swapped into 546.36 ETH, roughly $1.44 million when it looked.

A crash counted three ways

NTX fell to a record low, and no two outlets agree how far. BeInCrypto and The Cryptonomist give more than 70% in a day, with a floor of $0.000328. AMBCrypto counts 95.7% and a floor of $0.00005559. TronWeekly says over 90% and $0.00005338. Those floors differ by a factor of six, none of the accounts acknowledges another, and we could not establish which reading the exchange data supports. FET moved less and is disputed as well, at about 5% down on two readings against about 9% on a third, on a day when the whole market fell about 4%.

Nobody has said the bridge is fixed

BeInCrypto says it approached Fetch.ai and NuNet and that neither had issued a statement. Nothing read here says the converter has been paused, patched or redeployed, so the state of the bridge on Sunday is unknown. September's loss tally is above $333 million, counted across 17 incidents by one outlet and 18 by another, most of it the $320 million that left Blockstream's Liquid federation this month. This desk covered a $3.5 million oracle exploit at Nostra on Starknet in the same stretch. Two million dollars is small beside those. The cost that no tally carries sits with NTX holders, in a token whose daily volume ran at about $168,000 on one account's figure.