$FET A ~$2M exploit hit Fetch.ai and NuNet. The interesting part is where the trust boundary failed.
According to security researchers, an attacker exploited Fetch.ai’s Ethereum TokenConversionManagerV3 and drained roughly $1.56M worth of FET. The same attacker was linked to activity involving NuNet, where roughly $452K worth of NTX was maliciously minted. That puts the reported combined value around $2M.
Blockaid and PeckShield linked the activity to the same attacker. Fetch.ai acknowledged the incident and said it was investigating, while users were urged to avoid interacting with the affected contracts.
That’s what we know.
My interpretation is different from simply calling this an “AI token hack.”
The bigger issue is authorization.
A token can have a strong narrative, but if the mechanism deciding who can execute conversions or create supply has a weakness, the narrative doesn’t protect the system. Fetch.ai appears to have suffered unauthorized movement of existing tokens, while the NuNet incident involved unauthorized token creation. Those are different failure modes, but both expose the same broader problem: smart-contract trust assumptions matter more than the sector narrative.
I’m not treating the exact root cause as settled yet. The investigation still matters.
For me, this is a reminder to analyze the authorization layer, not just the AI thesis.
What part of the security model would you examine first?
According to security researchers, an attacker exploited Fetch.ai’s Ethereum TokenConversionManagerV3 and drained roughly $1.56M worth of FET. The same attacker was linked to activity involving NuNet, where roughly $452K worth of NTX was maliciously minted. That puts the reported combined value around $2M.
Blockaid and PeckShield linked the activity to the same attacker. Fetch.ai acknowledged the incident and said it was investigating, while users were urged to avoid interacting with the affected contracts.
That’s what we know.
My interpretation is different from simply calling this an “AI token hack.”
The bigger issue is authorization.
A token can have a strong narrative, but if the mechanism deciding who can execute conversions or create supply has a weakness, the narrative doesn’t protect the system. Fetch.ai appears to have suffered unauthorized movement of existing tokens, while the NuNet incident involved unauthorized token creation. Those are different failure modes, but both expose the same broader problem: smart-contract trust assumptions matter more than the sector narrative.
I’m not treating the exact root cause as settled yet. The investigation still matters.
For me, this is a reminder to analyze the authorization layer, not just the AI thesis.
What part of the security model would you examine first?