Stolen Bridge Key Lets Attacker Mint 260 Million AGIX on Ethereum

The attacker who drained Fetch.ai and NuNet over the weekend also minted 260 million AGIX and 53.8 million WMTx on Ethereum through SingularityNET's cross-chain bridge. PeckShield linked the new mints to the same actor on Sunday, and PANews and The Crypto Times both carried its alert. Fetch.ai now says the root cause was a stolen signing key for that bridge. AGIX-to-FET conversions are paused. SingularityNET had published no statement of its own by Monday morning.

What the attacker holds

PeckShield valued the attacker's holdings at about $16.77 million. That breaks down as 198.3 million AGIX worth about $14.42 million, 649 ether worth about $1.67 million and 33.5 million WMTx worth roughly $627,000. The first two legs came on Saturday evening, 8.72 million FET taken from a Fetch.ai converter and 408.5 million NTX minted from NuNet's deployer, which this desk covered as one wallet draining two projects for about $2 million. Fetch.ai's preliminary report, relayed by KuCoin, gave the same wallets 547.89 ether and 230 million NTX. That snapshot is earlier than PeckShield's. We could not establish which holdings changed in between. The Crypto Times cites Bitquery counting about 2.3 billion unauthorized tokens across four assets, a tally no other account repeats.

A key, not only a contract

Saturday's first diagnosis, from SlowMist, pointed at a converter that accepted one signature as its whole authorization. Fetch.ai's own report goes a step further back and names where the valid signatures came from.

"The root cause of the attack was the theft of the backend signature key for the SingularityNET cross-chain bridge," the Fetch.ai report said.

The two readings fit together. A stolen key produces signatures the contract has no reason to reject. Fetch.ai marks its report as not final. It does not say how the key was taken, and nobody else has said so either. Keys have been the costlier failure this year, and this desk tallied stolen keys outrunning code bugs in DeFi's 2026 losses earlier this month.

Who paused what

Fetch.ai says its own contracts were not at risk and FET works normally, and that the attack targeted SingularityNET's contracts, mainly the bridge between Ethereum and Cardano. It paused AGIX-to-FET conversions until further notice and paused its Ethereum-side bridge contract as a precaution, while saying it saw no sign of a flaw there. The Cryptonomist quotes it saying the exploit has been contained and that paused services will be restored when safe. World Mobile, which issues WMTx, confirmed the unauthorized mint and asked exchanges to freeze deposits. It is working to revoke minting rights and taking a pre-exploit snapshot, The Crypto Times reports, and has warned holders about fake support messages.

Prices, counted twice

FET is where the readings split. Blockonomi had it at about $0.1773, down 1.53% in a day, while The Crypto Times gave about $0.172 and a fall near 5%. The two do not reconcile. The Crypto Times also puts WMTx down about 43%. The dollar value of the FET leg still sits at $1.53 million, $1.55 million or $1.56 million depending on the account, on an agreed count of 8.72 million tokens.

The outstanding question belongs to SingularityNET. It runs the bridge, and it has not said whether the key has been rotated, what the 260 million AGIX do to supply, or when conversions reopen.