Fetch.ai Exploit Drains 2M USD, NTX Collapses 95 Percent

Two interconnected crypto projects are cleaning up after a roughly 2 million USD exploit that began with a weak security check in Fetch.ai’s token converter and ended with an unauthorized mint of more than 408 million NuNet (NTX) tokens and a 95.7 percent collapse in NTX’s price.

The root cause, according to an AMBCrypto reconstruction of the incident, was deceptively simple: the Fetch.ai system on Ethereum accepted a single “approval” signature without verifying whether the approved tokens had actually been locked or burned. After obtaining the private key behind that signature, the attacker was able to create an approval of their own and withdraw the bridge’s entire FET balance in one transaction — 8.72 million FET worth approximately 1.54 million USD at the time.

The same wallet cluster later received 408.5 million newly minted NTX tokens, worth roughly 463,000 USD. The shared destination address ties both incidents to a single operator, and the rapid consolidation of assets across the two ecosystems suggests a deliberate effort to gather proceeds quickly. Together, the two legs of the attack produced losses of around 2 million USD.

NTX takes the catastrophic hit

The market consequences diverged sharply between the two tokens. NTX, the token of NuNet — a project that decentralizes computing power for AI agents and has been integrating with the Artificial Superintelligence Alliance ecosystem — fell from approximately 0.00130 USD to 0.0000555 USD after the unauthorized mint flooded 408.5 million new tokens into circulation. That is a 95.7 percent drawdown, the kind of collapse usually associated with a depeg or a full governance failure rather than a bridge exploit.

Trading volume in NTX actually surged 131.6 percent to 168,080 USD, but the spike reflected panicked selling rather than bargain hunting, and it did nothing to stabilize the price. As of Sept. 20, NTX trades near 0.00028 USD — a token now in full price-discovery-with-no-floor territory, its circulating supply permanently inflated by an emission nobody authorized.

FET, by contrast, bent without breaking. In the three days before the exploit, FET had rallied nearly 27 percent, from 0.1490 USD to 0.1889 USD. The attack pushed the token back down to roughly 0.1711 USD — about a 9 percent decline from that local peak, and it has since stabilized around 0.17 USD. The difference is supply mechanics: because the attacker simply transferred existing FET out of the bridge rather than minting new FET, there was no dilution of the token’s supply. The market absorbed the theft as a transfer of ownership, not an expansion of the float.

The overhang problem

That is not to say FET holders are in the clear. The stolen 8.72 million FET represents only about 0.038 percent of circulating supply — manageable relative to daily traded volume — but stolen tokens have a way of returning to the market at the worst possible time. Much of the haul has reportedly already been moved out, but any remainder constitutes a standing sell overhang. Until every token held by the attacker is traced, frozen or depleted, the recovery case for FET carries an asterisk.

For NTX the question is more fundamental: the unauthorized mint cannot be un-minted without a coordinated intervention such as a freeze at exchange level, a token swap, or a migration to a new contract. Each of those paths carries its own trust costs for a small-cap project that just demonstrated its mint controls could be bypassed.

A familiar lesson, restated

The technical failure mode here — an approval that was accepted without verifying the state of the tokens it referenced — belongs to the same family of bugs that has haunted bridges and token converters for years: assumptions about what a signature implies, rather than verification of what the contract state actually is. Bridge and converter contracts remain the single most exploited category in crypto, precisely because they concentrate large token balances behind a small surface area of custom logic.

The Fetch.ai incident also illustrates a second, less-discussed risk: ecosystem coupling. The ASI alliance links multiple tokens and infrastructure components, and an exploit in one project’s converter cascaded into an unauthorized mint in another project’s token. Security teams tend to audit their own contracts; the attack surface that actually gets exploited is often the seam between two systems that each assumed the other had done the checking.

Neither project has published a full post-mortem as of Sept. 20. The roughly 2 million USD involved is small by the standards of 2026’s biggest exploits, but for NuNet it may prove existential, and for Fetch.ai it is an unwelcome distraction at a moment when AI-agent tokens were recovering strongly. The broader market takeaway is unchanged from every previous bridge failure: in crypto, the most dangerous code is the glue.