SingularityNET Bridge Attack Widens Into Multi-Project Key Compromise

Attack Expands From Fetch.ai and NuNet Into AGIX and WMTx

A security incident initially linked to Fetch.ai and NuNet has expanded into a much broader compromise involving SingularityNET’s multi-token bridge infrastructure, with the same attacker cluster tied to unauthorized creation of AGIX, WMTx and other tokens across connected projects.

Blockchain security firm PeckShield reported that the attacker responsible for the earlier Fetch.ai and NuNet incidents subsequently minted 260 million SingularityNET tokens, or AGIX, and 53.838 million World Mobile tokens, or WMTx, on Ethereum without authorization.

At the time of PeckShield’s snapshot, addresses associated with the attacker held cryptocurrency with a nominal market value of approximately $16.77 million. That included roughly 198.3 million AGIX valued near $14.42 million, 649 ETH worth about $1.67 million and 33.538 million WMTx worth around $627,000.

The $16.77 million figure should not be interpreted as realized proceeds. Much of the value consists of unauthorized tokens whose available liquidity is far smaller than their headline market value.

The expanded incident follows the September 19 drain of 8.72 million FET, worth roughly $1.5 million at the time, from Fetch.ai’s TokenConversionManagerV3 contract. Around half an hour later, approximately 408.5 million NTX were created through a NuNet deployer account and sent into the same attacker cluster.

The connection between the incidents became more significant after Fetch.ai’s preliminary investigation traced the FET event to a compromised signing key associated with SingularityNET’s bridge infrastructure. Fetch.ai said its own broader contracts remained secure and later clarified that the attack primarily affected SingularityNET’s bridge between Ethereum and Cardano.

The episode adds to a recent series of cryptocurrency incidents in which control of privileged credentials rather than a broken blockchain has become the main attack vector. Earlier this month, a compromised key stored on a former ApeX team member’s device led Indonesian exchange INDODAX to suspend APEX deposits and withdrawals.

Fetch.ai paused AGIX-to-FET conversions and temporarily paused its Ethereum-side bridge as a precaution, while saying it had found no indication that the Fetch.ai bridge itself contained the vulnerability.

World Mobile separately confirmed that unauthorized WMTx had been minted through the SingularityNET bridge. The project began coordinating with exchanges to freeze affected deposits, moved to revoke minting authorities and advised users not to interact with WMTx while it prepared a pre-exploit snapshot.

Exchange intervention is a common containment measure after token-level security incidents because unauthorized supply can otherwise move rapidly onto centralized trading venues. Crypto.com recently suspended deposits for 22 assets over an ongoing security concern, illustrating how exchanges can isolate affected networks while the underlying issue is investigated.

Onchain Analysis Points to a Much Larger Unauthorized Supply Event

PeckShield’s figures may represent only part of the incident.

Blockchain analytics firm Bitquery subsequently reconstructed the affected contracts and reported approximately 2.3 billion token units minted or drained across five assets during the attack window.

Its analysis counted 8.72 million FET removed from the Fetch.ai converter, 408.53 million unauthorized NTX, approximately 895.96 million AGIX, 500.48 million WMTx and 492.4 million CGV belonging to Cogito Finance.

Those figures are substantially larger than PeckShield’s earlier AGIX and WMTx snapshot. The difference does not necessarily mean one dataset is wrong: PeckShield’s alert described part of the activity and the assets remaining in tracked wallets at that point, while Bitquery attempted to reconstruct all minting activity across the contracts involved.

Bitquery estimated that only around $2.25 million had actually been converted into liquid assets or remained as readily realizable funds, reinforcing the difference between unauthorized token supply and actual financial proceeds.

The firm also found a critical structural link between what initially appeared to be attacks against separate projects.

SingularityNET’s own documentation shows that its bridge supports AGIX, NTX, FET, WMTx, RJV and CGV. The system moves tokens between Ethereum and Cardano using a burn-and-mint mechanism: tokens are destroyed on one chain and corresponding tokens are created on the other.

World Mobile’s relationship with the infrastructure is also documented publicly. SingularityNET announced in 2024 that WMTx had been integrated directly into its multi-token bridge following work between the two teams.

That means the incident is not simply a coincidence involving several unrelated projects. Multiple affected tokens were using the same SingularityNET bridge architecture.

Cross-chain systems have long been treated as one of crypto’s highest-risk infrastructure layers. BNB Chain, for example, recently introduced additional cross-chain bridge security controls through its Pasteur upgrade, including stricter validation of bridge-related signatures.

The Bigger Question Is How Many Privileged Keys Were Exposed

The most important unanswered question is no longer whether one bridge key was compromised.

It is how an attacker appears to have gained enough privileged access to affect several tokens and projects within the same operational ecosystem.

Bitquery’s analysis suggests the attacker had access to multiple authorization credentials. It found that the NTX incident differed technically from the FET drain: rather than relying only on a bridge conversion signature, the attacker directly invoked the NTX token’s mint function using privileged authority.

The firm also identified activity involving multiple wallets it associated with SingularityNET and NuNet personnel or infrastructure before the large token mints began.

Those findings have not yet been confirmed in a final official post-mortem, so they should not be treated as proof that one employee device, server or internal system exposed every credential.

But they change the security question considerably.

A single stolen private key is one incident. Several privileged credentials belonging to interconnected projects becoming accessible within the same attack window potentially points to a shared operational environment, common key-management system or broader infrastructure compromise.

Similar distinctions matter in other security events. Swiss Bitcoin Pay recently took its servers offline after suspected unauthorized access to internal systems, demonstrating why identifying the initial point of access can matter as much as tracking the transactions that follow.

So far, neither SingularityNET nor the affected projects have publicly established whether the compromised credentials were stored on one machine, managed by the same personnel, generated through a common system or exposed through separate attacks.

That is now the central issue for investors.

The Smart Contracts May Have Worked Exactly as Designed

There is an uncomfortable technical detail behind this attack: some of the contracts may not have been “hacked” in the conventional sense at all.

If a smart contract is programmed to mint tokens whenever it receives a valid signature from an authorized key, then a criminal holding that key can make the contract execute perfectly legitimate code for an illegitimate purpose.

The blockchain sees a valid signature.

It does not know the key was stolen.

That is why key management can be more important than the smart-contract code itself.

The debate resembles the broader problem facing cryptocurrency custody. Keeping cryptographic keys technically secure is only one layer of protection. Dave Finances has previously examined the trade-offs around hardware-wallet and transaction-signing security, where a legitimate key can still authorize a harmful action if the operational environment around it has been compromised.

In the SingularityNET case, the risk is amplified because the keys did not protect one person’s wallet. They appear to have controlled infrastructure capable of creating or releasing token supply for multiple projects.

The $16.8 Million Headline Understates the Structural Damage

The easiest number to focus on is $16.77 million.

It may not be the most important one.

Much of the attacker wallet’s quoted value came from tokens that the attacker had just created. A token may have a quoted market price, but dumping hundreds of millions of newly minted units into thin liquidity can collapse that price long before anything close to the theoretical value is extracted.

Bitquery’s estimate that realized and liquid value was closer to a few million dollars illustrates that problem.

The lasting damage is the supply distortion.

According to Bitquery’s reconstruction, unauthorized AGIX represented a substantial portion of the token supply across Ethereum and Cardano, while the 408.5 million NTX mint pushed the measured cross-chain supply well beyond NuNet’s published one-billion-token cap.

Correcting that problem is harder than simply freezing an attacker wallet.

Projects may need snapshots, migrations, token burns, replacement contracts or exchange coordination to distinguish legitimate tokens from unauthorized ones. Each solution introduces operational complexity and potentially forces holders, liquidity providers and exchanges to agree on which version of the supply should be treated as legitimate.

This is why self-custody alone does not solve every blockchain-security problem. Users can control their own wallets while still depending on bridge operators and token issuers to maintain privileged infrastructure safely. The distinction is visible in products built around self-custodial blockchain infrastructure: removing custody risk does not automatically remove protocol or administrative-key risk.

For the affected projects, the next post-mortem needs to go beyond identifying the attacker wallet.

It needs to explain where each signing and minting key was stored, whether those keys shared infrastructure, who had access to them, when the compromise began, whether other privileged credentials remain exposed and why one attacker was apparently able to move across several tokens in the same ecosystem.

Until those questions are answered, this should not be viewed as four isolated token incidents.

The onchain evidence increasingly points to one shared security failure spreading through a bridge system that connected them.