A roughly $2 million exploit involving Fetch.ai and NuNet has exposed a security risk that is easy to underestimate: a token can have secure smart-contract logic and still depend on dangerous offchain permissions.
Security researchers linked the same attacker cluster to two events.
First, approximately 8.7 million FET, worth about $1.5 million at the time, was removed from Fetch.ai’s Ethereum TokenConversionManagerV3 contract.
Shortly afterward, roughly 408.5 million NTX was minted without authorization from a NuNet deployer account and sent to the same recipient cluster.
The combined value cited by security firms was around $2 million at the time of the incidents.
NTX suffered a much larger market reaction than FET because the second incident did not simply transfer existing tokens.
It created new supply.
The FET Incident Was an Authorization Problem
Blockaid reported that the Fetch.ai converter accepted valid conversion-authorization data when the attacker called the contract’s conversion function.
Later reporting citing Fetch.ai’s preliminary analysis said a signing key had been compromised.
That distinction matters.
The attacker did not necessarily “break” Ethereum or bypass cryptography.
If an attacker obtains a valid signing credential, the smart contract can behave exactly as designed and still release funds to the wrong party.
The software sees a valid authorization.
The system has already lost control one layer earlier.
Smart Contract Security Includes Offchain Keys
Crypto security analysis often focuses on contract code.
But many contracts depend on external authority:
- multisig signers;
- oracle keys;
- bridge validators;
- minting accounts;
- conversion authorizers;
- deployer wallets;
- admin roles.
The security of the contract can never exceed the security of the authority it trusts.
That creates a useful principle:
permission risk is smart-contract risk.
A contract audit that ignores key custody, signer rotation and authorization scope is incomplete.
The NuNet Mint Shows Why Supply Integrity Is Different From Treasury Loss
The NuNet incident is economically more revealing.
An attacker reportedly obtained or abused a deployer-level capability and minted approximately 408.5 million NTX.
That is not merely theft from a treasury.
It attacks the asset’s scarcity assumption.
A holder prices a token partly on the expectation that supply follows known rules.
Unauthorized minting breaks that expectation.
Even if the dollar value minted at the moment of attack is relatively small, the market can reprice the token far more aggressively because confidence in the supply function has changed.
That helps explain why NTX fell much more sharply than FET after the incident.
One Wallet Across Two Projects Raises Shared-Permission Questions
The same receiving cluster linking the FET drain and NTX mint is one of the most important details.
It suggests that what looked initially like separate protocol incidents may share an operational or credential-security dimension.
That does not prove that both projects used exactly the same compromised key.
The root-cause investigation remains incomplete.
But correlated compromise across related projects should trigger a broader review.
Security teams should not rotate only the credential visibly involved in the first transaction.
They should ask:
What other contracts trust the same signer?
What other projects share deployment infrastructure?
Which keys were generated, stored or operated through the same environment?
AI-Crypto Projects Have a Supply-Chain Problem Too
Fetch.ai and NuNet sit inside the broader decentralized AI and compute ecosystem.
That ecosystem often integrates tokens, model infrastructure, compute markets, bridges and cross-chain conversion systems.
The more tightly connected the products become, the more important privilege boundaries become.
A shared alliance can create useful network effects.
It can also create shared operational dependencies.
The security model therefore needs an entity graph, not just a contract list.
Why It Matters
The incident provides a strong framework for evaluating token security.
Investors often ask:
“Has the contract been audited?”
A better set of questions is:
- Who can mint?
- Who can upgrade?
- Who can authorize conversions?
- How many signatures are required?
- Are limits enforced onchain?
- Can one EOA authorize a large transfer?
- Can permissions be revoked quickly?
- Are keys isolated between related projects?
Those questions determine whether the token’s economic rules are actually enforceable.
Market Impact Should Be Interpreted Carefully
Reports placed the unauthorized NTX mint at roughly $460,000 at the time it occurred.
But thin liquidity means the nominal value of newly minted supply is not the same as realizable proceeds.
It also means price can collapse much more than the exploit value would suggest.
A large unauthorized mint creates an overhang.
Even if the attacker cannot sell all tokens near the pre-attack price, holders may sell first because they no longer trust the supply.
The market is pricing credibility, not only immediate cash loss.
Risks and Counterarguments
The full technical post-mortems were not available at the time of writing.
Security firms have provided transaction-level evidence, but the exact credential-compromise path and relationship between the Fetch.ai and NuNet incidents remain under investigation.
Reported token-price declines also vary depending on the measurement window and liquidity source.
The approximately $2 million figure is best treated as the estimated value of the initially identified FET drain and NTX mint at the time, not necessarily the attacker’s realized profit.
What to Watch Next
Watch Fetch.ai and NuNet’s technical reports, credential-rotation details and any contract migrations.
The most important questions are whether the signing-key compromise affected additional contracts, whether mint authority is redesigned, and whether future conversion functions enforce onchain limits rather than relying primarily on an external signature.
Also watch exchange actions on FET and NTX deposits and withdrawals.
The lasting lesson is broader than this exploit:
token supply is secure only when the permissions controlling that supply are secure.
FAQ
How much FET was removed?
Security researchers reported about 8.7 million FET, worth roughly $1.5 million at the time.
What happened to NuNet?
Approximately 408.5 million NTX was reportedly minted without authorization.
Were the two events linked?
Security firms linked them through the same receiving wallet cluster.
Does this mean the contract cryptography was broken?
Not necessarily. Reporting indicates valid authorization data or a compromised signing key was involved, meaning the failure may have occurred at the permission layer.
Why did NTX react so sharply?
Unauthorized minting changes the expected token supply, creating dilution and confidence risk beyond the immediate dollar value of the exploit.