SingularityNET Bridge Attack Minted 2.3 Billion Unauthorized Tokens
The attacker released 8.72 million FET, exchanged it for 522.78 ETH and realized about $2.29 million in crypto and stablecoins.
An attacker exploited SingularityNET bridge infrastructure on Sept. 19, releasing 8,721,530.40 Fetch.ai (FET) tokens and minting about 2.3 billion unauthorized tokens across four assets.
The incident used compromised signing and minting privileges within part of SingularityNET’s cloud infrastructure. The released FET was exchanged for 522.78 Ether (ETH), and the two principal attacker wallets had received about 742.7 ETH equivalent and $362,075 in stablecoins by Sept. 22. Those assets totaled roughly $2.29 million in realized proceeds, excluding unsold tokens.
The FET was released from Fetch.ai’s Ethereum conversion contract at 4:21 p.m. ET Sept. 19 (20:21 UTC). About 29 minutes later, 408,532,878.13 NuNet (NTX) tokens were minted through a direct mint() call.
The attacker minted 895,962,344.71 SingularityNET (AGIX) tokens in 90 transactions between 11:13 p.m. Sept. 19 and 12:21 a.m. ET Sept. 20 (03:13–04:21 UTC). The unauthorized issuance also included 500,479,231.22 World Mobile (WMTX) tokens across 503 transactions and 492,397,101.16 Cogito (CGV) tokens across 50 transactions.
An earlier estimate valued the attacker’s holdings at about $16.77 million, including unsold tokens at prevailing market prices. That figure represented the nominal value of the wallet holdings rather than realized proceeds.
The affected bridge infrastructure connects Ethereum and Cardano by burning tokens on one network and releasing or minting corresponding tokens on the other. The contracts accepted valid signatures from authorized addresses but did not independently verify that the underlying cross-chain burn had occurred.
The FET conversion function also lacked a limit check used elsewhere in the contract, allowing one request to exceed the stated 1 million FET maximum.
SingularityNET revoked the compromised access, disabled the affected bridges and conversion contracts, paused Ethereum transfers of AGIX and NTX, and kept the bridges offline pending an independent security review. Treasury and exchange wallets were not affected.
Eligibility and distribution rules for replacement tokens remained undisclosed.
