Security firms Blockaid and PeckShield found that last night the same wallet drained two crypto projects at once, Fetch.ai and NuNet, and made off with around $2 million. The attack first targeted the Fetch.ai token converter on the Ethereum network, where the attacker gained access with a valid signature from the conversion authorizer — a key that the contract trusts by default — and called the conversionIn function in the TokenConversionManagerV3 contract. A single call drained the converter’s entire remaining balance of 8.7 million FET, worth around $1.56 million.
The same wallet received 408.5 million NTX, worth approximately $452,000, through a NuNet deployer account that the team used to deploy its own contract. Blockaid publicly posted the attacker’s addresses and examples of the transactions so that exchanges and other projects could block the movement of these funds in time. The attacker swapped the stolen assets for 546.36 ETH, worth around $1.44 million.
NTX holders did not take the outcome of the hack well: the token plunged more than 70% within a day and hit an all-time low of $0.000328. FET losses were much smaller, around -5%, against the backdrop of a broader -4% decline in the crypto market. Researchers advise token holders not to access the platforms until the teams confirm that they are safe to use.
September has already been an expensive month for the industry even without this hack. According to DefiLlama, before the Fetch.ai incident, the month had already brought $331 million in losses across 17 incidents, with $320 million of that coming from Liquid Network. Just three days earlier, the Nostra protocol lost $3.5 million due to price manipulation in its oracle. Today’s hack added another $2 million to the tally.
Every channel in the catalogue is checked by the editors against one method: it is how we work out the rating, place a channel at a risk level and decide whether it belongs in Market Scam.