{"investigation":{"slug":"singularitynet-agix-wmtx-bridge-key-compromise","entity_name":"SingularityNET (AGIX/WMTx Bridge Key Compromise)","trust_score":12,"severity_base":null,"score_modifier":0,"confidence":0.75,"status":"draft","content_type":"investigation","summary":"In September 2026, a compromised offline signing key used to authorize cross-chain conversions on the linked Fetch.ai/SingularityNET/NuNet/World Mobile token-bridge stack allowed an attacker to drain FET from Fetch.ai's TokenConversionManagerV3 contract and illegally mint hundreds of millions of AGIX, NTX, and WMTx tokens. The exploit caused AGIX's price to collapse over 99% within 24 hours, wiped an estimated $93 million in AGIX market capitalization, and left the attacker holding an estimated $16.77 million across five tokens. As of the most recent reporting, SingularityNET had not issued a standalone public incident statement, and the compromised authorizer key reportedly remained unrotated more than 48 hours after the exploit began.","sections":[{"content":"Beginning on September 19, 2026, an attacker used a validly-signed but compromised authorization from the bridge's offline conversion-authorizer key to call the conversionIn function on Fetch.ai's TokenConversionManagerV3 contract, draining approximately 8,721,530 FET (reported as roughly $1.53-1.55 million) without the transaction being subject to the same per-transaction limit checks applied to outbound conversions. According to reporting citing Fetch.ai's own preliminary on-chain analysis, the conversionIn function checked only for a single ECDSA signature and did not verify that corresponding tokens had actually been locked or burned elsewhere in the bridge stack, nor did it enforce a per-conversion cap. Using the same compromised key alongside a separately compromised, allegedly dormant NuNet minter key dating to 2023, the attacker went on to mint 408.5 million NTX (about 42% of total NTX supply) approximately 29 minutes after the initial FET drain, followed by 260 million AGIX and 53.838 million WMTx (World Mobile token) across the linked bridge infrastructure on Ethereum. Blockchain analytics firm PeckShield identified the AGIX and WMTx mints and attributed them to the same attacker behind the earlier FET and NTX incidents. The root-cause assessment reported by outlets citing Fetch.ai's analysis characterizes the incident as a key-custody or signing-service compromise rather than a smart-contract logic bug, since the fraudulent conversion carried a technically valid signature from the bridge's own authorizer key.","heading":"Bridge Key Compromise and Fraudulent Minting","sources":[{"url":"https://mpost.io/key-compromise-behind-fetch-ai-linked-bridge-attack-drives-losses-to-16-77m/","name":"Key Compromise Behind Fetch.ai-Linked Bridge Attack Drives Losses To $16.77M - Metaverse Post","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","name":"SingularityNET Bridge Hack Widens: 260M AGIX, 53.8M WMTx Minted, $16.77M Held by Attacker - Crypto Times","type":"news_article","credibility":2},{"url":"https://startupfortune.com/a-forged-signature-drained-fetchai-and-crashed-nunets-ntx-token/","name":"A Forged Signature Drained Fetch.ai and Crashed NuNet's NTX Token - Startup Fortune","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/fetch-ai-and-nunet-hit-in-attacks-linked-to-a-compromised-private-key/","name":"Fetch.ai and NuNet hit in attacks linked to a compromised private key - Cryptopolitan","type":"news_article","credibility":2},{"url":"https://panews.io/articles/01a0be2e-f8c9-738c-a585-a4d7708cc32b","name":"PeckShield: Same attacker breached SingularityNET, illicitly minting 260 million AGIX and 53.838 million WMTx - PANews","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the fraudulent mint of 260 million AGIX tokens, AGIX's price collapsed more than 99% within 24 hours, reported by one outlet as falling from approximately $0.0775 to approximately $0.0006841. The crash wiped an estimated $93 million from AGIX's market capitalization based on its approximately 1.21 billion circulating supply at the time. NTX, NuNet's token, fell between 65% and 95% depending on the tracker cited, with at least one source reporting an all-time low near $0.00004075. WMTx fell approximately 43% in the aftermath. FET itself was comparatively stable, dropping only about 5% (from roughly $0.18 to $0.172-$0.1773), consistent with reporting that FET tokens were drained/removed rather than fraudulently created, and that Fetch.ai's core FET contract was not itself compromised.","heading":"AGIX Price Collapse and Market Impact","sources":[{"url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","name":"SingularityNET Bridge Hack Widens: 260M AGIX, 53.8M WMTx Minted, $16.77M Held by Attacker - Crypto Times","type":"news_article","credibility":2},{"url":"https://blockzeit.com/singularitynet-crashes-over-99-in-24-hours-due-to-exploit/","name":"SingularityNET Crashes Over 99% In 24 Hours Due To Exploit - Blockzeit","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/singularitynet-bridge-exploit-forces-fetch-ai-to-pause-agix-fet-conversions/","name":"SingularityNET Bridge Exploit Forces Fetch.ai to Pause AGIX-FET Conversions - Crypto Economy","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Reporting citing on-chain data places the initial exploit transaction at 20:21:47 UTC on September 19, 2026 (block 26,013,913), with the NuNet NTX mint following at 20:50:11 UTC the same day. Public acknowledgment did not occur until the morning of September 20, 2026: World Mobile Chain confirmed bridge exploitation at 05:07 UTC, followed by a further warning about a pre-exploit snapshot at 06:31 UTC, and Fetch.ai's first acknowledgment of \"converter-related reports\" came at 06:51 UTC — a detection-to-acknowledgment gap of roughly 10 hours. Fetch.ai posted preliminary on-chain analysis at 08:51 UTC, and PeckShield reported the 260 million AGIX and 53.838 million WMTx mints at 09:21 UTC. Fetch.ai paused its Ethereum-side bridge at 12:51 UTC and later confirmed at 16:19 UTC that core FET operations remained normal. Response actions reported across multiple outlets include: freezing/pausing the AGIX-FET migration contract, pausing bridges on Ethereum and Cardano, deactivating affected wallets and contracts in coordination between Fetch.ai and SingularityNET, and several exchanges (including Bitget and KuCoin, according to reporting) suspending deposits of the affected tokens. Notably, as of the most recent reporting reviewed (September 21, 2026), the compromised conversion-authorizer key had reportedly not been rotated and the compromised NuNet minter role had not been revoked, meaning the underlying attack vector remained technically viable more than 48 hours after the initial exploit. Reporting also notes that SingularityNET itself had not, at that point, published a standalone incident statement on X/Twitter comparable to those issued by Fetch.ai and World Mobile Chain — public communication about the incident affecting SingularityNET's own token was led primarily by Fetch.ai, World Mobile Chain, and third-party analytics firms rather than by SingularityNET directly.","heading":"Detection Gap and Incident Response","sources":[{"url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","name":"SingularityNET Bridge Hack Widens: 260M AGIX, 53.8M WMTx Minted, $16.77M Held by Attacker - Crypto Times","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/singularitynet-bridge-exploit-forces-fetch-ai-to-pause-agix-fet-conversions/","name":"SingularityNET Bridge Exploit Forces Fetch.ai to Pause AGIX-FET Conversions - Crypto Economy","type":"news_article","credibility":2},{"url":"https://mpost.io/key-compromise-behind-fetch-ai-linked-bridge-attack-drives-losses-to-16-77m/","name":"Key Compromise Behind Fetch.ai-Linked Bridge Attack Drives Losses To $16.77M - Metaverse Post","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of September 21, 2026, on-chain analysts estimated the attacker's total controlled value at approximately $16.77 million spread across five tokens: approximately 198.3 million AGIX (~$14.42 million), 649 ETH (~$1.67 million), and approximately 33.538 million WMTx (~$6.27 million per one source, ~$627,400 per another — sources differ on this figure), plus residual FET and NTX holdings. Reporting indicates approximately $2.25 million of the attacker's holdings had already been realized through sales as of that date. Specific attacker-associated addresses reported in coverage include a recipient wallet (0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE), an initiating address (0x1572F2af7696b39c85E3221CDE8EFb640F86c362), the TokenConversionManagerV3 contract (0xab424A430CC09864fA1277A38193111705ADF3A3), the NTX token contract (0xF0d33BeDa4d734C72684b5f9abBEbf715D0a7935), and the NuNet deployer address (0x863F13e5B505f1Eb17803b94EC9d3DaF80092165). These addresses are drawn from secondary reporting rather than independently verified by this investigation and should be treated as provisional pending confirmation via a block explorer.","heading":"Total Attacker Holdings and Fund Movement","sources":[{"url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","name":"SingularityNET Bridge Hack Widens: 260M AGIX, 53.8M WMTx Minted, $16.77M Held by Attacker - Crypto Times","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/hackers-exploit-singularitynet-bridge-vulnerability-illegally-mint-16-77m-in-agix-and-wmtx","name":"Hackers exploit SingularityNET bridge vulnerability, illegally mint $16.77M in AGIX and WMTx - KuCoin","type":"news_article","credibility":2}],"severity":"high"},{"content":"The SingularityNET/AGIX/WMTx mints were reported as a widening of an incident that began with the same attacker draining FET from Fetch.ai and illegally minting NTX on NuNet on September 19-20, 2026, an event separately tracked on AVOID.NET. Both incidents share the same root cause — a compromised bridge/conversion-authorizer signing key — and the same attacker, according to on-chain attribution by PeckShield. This suggests a shared, cross-project bridge/custody architecture linking Fetch.ai, SingularityNET, and NuNet (all part of the ASI/Artificial Superintelligence Alliance ecosystem) whose signing-key security failed across multiple linked token-conversion paths rather than a flaw isolated to a single project.","heading":"Pattern: Linked Fetch.ai/NuNet Precursor Incident","sources":[{"url":"https://beincrypto.com/fetch-ai-nunet-2-million-exploit/","name":"Fetch.ai and NuNet Exploited for $2 Million by Same Attacker, NTX Hits All-Time Low - BeInCrypto","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/security/one-attacker-hits-two-crypto-projects-and-walks-with-2-million/","name":"One Attacker Hits Two Crypto Projects and Walks With $2 Million - Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/fetch-ai-and-nunet-hit-in-attacks-linked-to-a-compromised-private-key/","name":"Fetch.ai and NuNet hit in attacks linked to a compromised private key - Cryptopolitan","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2026-09-19","event":"Attacker uses a compromised bridge conversion-authorizer key to call conversionIn on Fetch.ai's TokenConversionManagerV3 contract, draining approximately 8.72 million FET (~$1.53-1.55M) at 20:21:47 UTC.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","date_evidence":"September 19, 2026, evening: TokenConversionManagerV3 contract drained of 8,721,530 FET (~$1.55M)"},{"date":"2026-09","event":"Using a separately compromised, reportedly dormant 2023 NuNet minter key, the attacker mints 408.5 million NTX (about 42% of total supply) roughly 29 minutes after the FET drain.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","date_evidence":"20:50:11 UTC: NuNet deployer account executed 408.53M NTX mint","date_original":"2026-09-19"},{"date":"2026-09","event":"World Mobile Chain publicly confirms exploitation of the SingularityNET cross-chain bridge, roughly 8-9 hours after the initial drain.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","date_evidence":"05:07 UTC: World Mobile Chain confirmed SingularityNET bridge exploitation","date_original":"2026-09-20"},{"date":"2026-09","event":"Fetch.ai issues its first public acknowledgment of \"converter-related\" incident reports, approximately 10 hours after the initial exploit transaction.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","date_evidence":"06:51 UTC: Fetch.ai first acknowledged converter-related reports","date_original":"2026-09-20"},{"date":"2026-09","event":"On-chain analytics firm PeckShield reports that the same attacker had illegally minted 260 million AGIX and 53.838 million WMTx on Ethereum via the compromised SingularityNET bridge.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","date_evidence":"09:21 UTC: PeckShield reported 260M AGIX and 53.838M WMTx Ethereum mints","date_original":"2026-09-20"},{"date":"2026-09","event":"Fetch.ai pauses its Ethereum-side bridge contract and freezes the AGIX-FET migration contract as a precautionary measure.","source":"Crypto Economy","source_url":"https://crypto-economy.com/singularitynet-bridge-exploit-forces-fetch-ai-to-pause-agix-fet-conversions/","date_evidence":"12:51 UTC: Fetch.ai paused its Ethereum-side bridge","date_original":"2026-09-20"},{"date":"2026-09","event":"AGIX price collapses more than 99% within 24 hours of the mint, wiping an estimated $93 million in market capitalization; NTX falls to a reported all-time low.","source":"Blockzeit / Coinotag","source_url":"https://blockzeit.com/singularitynet-crashes-over-99-in-24-hours-due-to-exploit/","date_original":"2026-09-20"},{"date":"2026-09","event":"PeckShield and subsequent reporting place total attacker-controlled value across five tokens at approximately $16.77 million, with roughly $2.25 million already realized through sales; the compromised authorizer key reportedly remains unrotated.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","date_original":"2026-09-21"}],"sources_used":[{"url":"https://mpost.io/key-compromise-behind-fetch-ai-linked-bridge-attack-drives-losses-to-16-77m/","name":"Key Compromise Behind Fetch.ai-Linked Bridge Attack Drives Losses To $16.77M - Metaverse Post","type":"news_article","archive_url":"https://web.archive.org/web/20260922162546/https://mpost.io/key-compromise-behind-fetch-ai-linked-bridge-attack-drives-losses-to-16-77m/","credibility":2,"archive_timestamp":"2026-09-22T16:25:46+00:00"},{"url":"https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","name":"SingularityNET Bridge Hack Widens: 260M AGIX, 53.8M WMTx Minted, $16.77M Held by Attacker - Crypto Times","type":"news_article","archive_url":"http://web.archive.org/web/20260921044125/https://www.cryptotimes.io/2026/09/21/singularitynet-bridge-hack-widens-260m-agix-53-8m-wmtx-minted-16-77m-held-by-attacker/","credibility":2,"archive_timestamp":"2026-09-21T04:41:25+00:00"},{"url":"https://www.kucoin.com/news/flash/hackers-exploit-singularitynet-bridge-vulnerability-illegally-mint-16-77m-in-agix-and-wmtx","name":"Hackers exploit SingularityNET bridge vulnerability, illegally mint $16.77M in AGIX and WMTx - KuCoin","type":"news_article","archive_url":"https://web.archive.org/web/20260922171531/https://www.kucoin.com/news/flash/hackers-exploit-singularitynet-bridge-vulnerability-illegally-mint-16-77m-in-agix-and-wmtx","credibility":2,"archive_timestamp":"2026-09-22T17:15:31+00:00"},{"url":"https://crypto-economy.com/singularitynet-bridge-exploit-forces-fetch-ai-to-pause-agix-fet-conversions/","name":"SingularityNET Bridge Exploit Forces Fetch.ai to Pause AGIX-FET Conversions - Crypto Economy","type":"news_article","archive_url":"https://web.archive.org/web/20260922171107/https://crypto-economy.com/singularitynet-bridge-exploit-forces-fetch-ai-to-pause-agix-fet-conversions/","credibility":2,"archive_timestamp":"2026-09-22T17:11:07+00:00"},{"url":"https://startupfortune.com/a-forged-signature-drained-fetchai-and-crashed-nunets-ntx-token/","name":"A Forged Signature Drained Fetch.ai and Crashed NuNet's NTX Token - Startup Fortune","type":"news_article","archive_url":"https://web.archive.org/web/20260922210819/https://startupfortune.com/a-forged-signature-drained-fetchai-and-crashed-nunets-ntx-token/","credibility":2,"archive_timestamp":"2026-09-22T21:08:19+00:00"},{"url":"https://beincrypto.com/fetch-ai-nunet-2-million-exploit/","name":"Fetch.ai and NuNet Exploited for $2 Million by Same Attacker, NTX Hits All-Time Low - BeInCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20260920070921/https://beincrypto.com/fetch-ai-nunet-2-million-exploit/","credibility":2,"archive_timestamp":"2026-09-20T07:09:21+00:00"},{"url":"https://news.bitcoin.com/security/one-attacker-hits-two-crypto-projects-and-walks-with-2-million/","name":"One Attacker Hits Two Crypto Projects and Walks With $2 Million - Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260921064418/https://news.bitcoin.com/security/one-attacker-hits-two-crypto-projects-and-walks-with-2-million/","credibility":2,"archive_timestamp":"2026-09-21T06:44:18+00:00"},{"url":"https://www.cryptopolitan.com/fetch-ai-and-nunet-hit-in-attacks-linked-to-a-compromised-private-key/","name":"Fetch.ai and NuNet hit in attacks linked to a compromised private key - Cryptopolitan","type":"news_article","archive_url":"https://web.archive.org/web/20260922211645/https://www.cryptopolitan.com/fetch-ai-and-nunet-hit-in-attacks-linked-to-a-compromised-private-key/","credibility":2,"archive_timestamp":"2026-09-22T21:16:45+00:00"},{"url":"https://panews.io/articles/01a0be2e-f8c9-738c-a585-a4d7708cc32b","name":"PeckShield: Same attacker breached SingularityNET, illicitly minting 260 million AGIX and 53.838 million WMTx - PANews","type":"news_article","archive_url":"http://web.archive.org/web/20260920130739/https://panews.io/articles/01a0be2e-f8c9-738c-a585-a4d7708cc32b","credibility":2,"archive_timestamp":"2026-09-20T13:07:39+00:00"},{"url":"https://blockzeit.com/singularitynet-crashes-over-99-in-24-hours-due-to-exploit/","name":"SingularityNET Crashes Over 99% In 24 Hours Due To Exploit - Blockzeit","type":"news_article","archive_url":"https://web.archive.org/web/20260922203449/https://blockzeit.com/singularitynet-crashes-over-99-in-24-hours-due-to-exploit/","credibility":2,"archive_timestamp":"2026-09-22T20:34:49+00:00"},{"url":"https://www.techflowpost.com/en-US/newsletter/137002","name":"SingularityNET attacked: hackers illegally mint AGIX and WMTx - TechFlow","type":"news_article","archive_url":"http://web.archive.org/web/20260921030159/https://www.techflowpost.com/en-US/newsletter/137002","credibility":2,"archive_timestamp":"2026-09-21T03:01:59+00:00"},{"url":"https://coindoo.com/one-attacker-multiple-tokens-inside-the-fetch-ai-breach/","name":"One Attacker, Multiple Tokens: Inside the Fetch.ai Breach - Coindoo","type":"news_article","archive_url":"http://web.archive.org/web/20260920125652/https://coindoo.com/one-attacker-multiple-tokens-inside-the-fetch-ai-breach/","credibility":2,"archive_timestamp":"2026-09-20T12:56:52+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-22T17:07:33.350114+00:00","updated_at":"2026-09-22T21:21:16.504018+00:00"}}