The exploit that emptied Fetch.ai’s Ethereum-based token converter and produced 408.5 million unauthorized NuNet Token (NTX) on September 19, 2026, has widened into a broader key-compromise event across the SingularityNET bridge stack, with the same attack cluster later minting 260 million SingularityNET Token (AGIX) and 53.838 million World Mobile Token (WMTx) on Ethereum on September 20, 2026.
Blockchain security monitors tracking the cluster valued its Ethereum holdings at approximately $16.77 million at the time of their alert, while Fetch.ai has said its own smart contracts remain safe and that FET continues to operate normally.
SingularityNET is a decentralized artificial intelligence (AI) marketplace and a founding member of the Artificial Superintelligence (ASI) Alliance, an ecosystem that also includes Fetch.ai, NuNet and Cogito Finance. Its native SingularityNET Token (AGIX) is a utility and payments asset; NuNet Token (NTX) settles decentralized compute payments; Cogito Finance’s governance token trades as CGV; and World Mobile Token (WMTx) is the Ethereum-side utility token of World Mobile Chain, a decentralized wireless network that has integrated the SingularityNET bridge to move value between Cardano and Ethereum. The Crypto Times reported earlier on the September 19 drain of the Fetch.ai converter contract and the linked NTX mint, which was the first cash event in the widening incident.
Blockchain security firm PeckShield reported at 09:21 UTC on September 20, 2026, that the exploiter had minted 260 million AGIX and 53.838 million WMTx on Ethereum. At the time of the alert, PeckShield valued the cluster’s holdings at about $16.77 million, comprising 198.3 million AGIX worth approximately $14.42 million, 649 ETH worth approximately $1.67 million, and 33.538 million WMTx worth approximately $627,350. The security firm had previously valued the FET drain at about $1.53 million and the NTX mint at about $462,730.
Separately, blockchain data provider Bitquery reported at 17:20 UTC on September 20, 2026, that roughly 2.3 billion newly created units across AGIX, NTX, CGV and WMTx were traced to the same actor, in addition to the 8.7 million FET drained from the Fetch.ai converter.
Bitquery noted that a large share of the remaining AGIX supply on Ethereum, Cardano and BNB Chain now appears to be unauthorized inventory. The Bitquery count spans additional tickers and chains and should be read alongside, not in place of, PeckShield’s Ethereum-only AGIX and WMTx snapshot.
What Fetch.ai and World Mobile Have Confirmed
Fetch.ai posted at 16:19 UTC on September 20, 2026, that Fetch.ai contracts were not under threat and that FET continues to operate normally. The team said the attack targeted SingularityNET contracts, “primarily the SingularityNET Bridge between Ethereum and Cardano,” and that the unauthorized mints used that route.
AGIX-to-FET conversions have been paused, and the Ethereum-side Fetch.ai bridge was paused as a precaution, with the team stating there was no indication of any vulnerability in it. Fetch.ai said the exploit had been contained and that it was continuing to work with SingularityNET.
An earlier Fetch.ai update at 08:51 UTC pointed to a preliminary on-chain analysis hosted on ASI:One that traced the path from a compromised signing key to cash-out wallets. The team said it had deactivated affected wallets and a contract together with SingularityNET, and cautioned that the write-up was preliminary and not a final analysis. Fetch.ai first acknowledged converter-related reports at 06:51 UTC on September 20 and paused its Ethereum-side bridge at 12:51 UTC on the same day.
World Mobile Chain confirmed at 05:07 UTC on September 20, 2026 that the SingularityNET bridge had been exploited and that WMTx had been minted on Ethereum without authorization, driving price action on listed venues. The team said it was contacting exchanges to freeze affected deposits and working with security partners to revoke minting authorities.
A follow-up message at 06:31 UTC said a pre-exploit snapshot was underway and told holders not to interact with WMTx while the investigation continued. Both posts warned against recovery direct messages, fake support accounts, and unofficial migration links.
At the time of this report, SingularityNET had not published a standalone incident statement on X comparable to those issued by Fetch.ai and World Mobile Chain.
On-Chain Timeline Already on Record
The FET drain remains the first confirmed cash event of the incident and occurred at 20:21:47 UTC on September 19, 2026, in Ethereum block 26,013,913. The transaction called the conversionIn function on the TokenConversionManagerV3 contract at 0xab424A430CC09864fA1277A38193111705ADF3A3 and moved 8,721,530.40 FET to the recipient wallet 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE. The initiating address was 0x1572F2af7696b39c85E3221CDE8EFb640F86c362.
Twenty-eight minutes later, at 20:50:11 UTC, the NuNet deployer account 0x863F13e5B505f1Eb17803b94EC9d3DaF80092165 executed a mint of 408.53 million NTX on the NTX token contract at 0xF0d33BeDa4d734C72684b5f9abBEbf715D0a7935 and sent the newly created supply to the same cluster wallet.
Fetch.ai’s later analysis described a stolen SingularityNET bridge authorizer key used to produce a valid signature for the converter call, alongside a separately compromised NuNet mint key used within the same window. The unauthorized AGIX and WMTx Ethereum mints followed from that cluster and underlie PeckShield’s $16.77 million holdings figure.
Exchange Action and Market Impact
Cryptocurrency exchange Bitget suspended FET deposits and withdrawals starting at 06:00 UTC+8 on September 20, 2026, citing wallet maintenance, with no resumption time specified. Cryptocurrency exchange KuCoin was separately reported to have halted FET deposits over the same window. FET traded near $0.18 at the time of the drain on September 19 and was quoted around $0.172 on September 20, down roughly 5% over 24 hours.
Newly minted supply drove NTX and WMTx sharply lower once it reached the market. NTX fell between 65% and more than 90% depending on the tracker used, while WMTx was reported down about 43% in early coverage of the SingularityNET-side leg of the incident.
What Remains Unclear
The public record still lacks a standalone root-cause post from SingularityNET, a full transaction list for the AGIX, WMTx and CGV mints, and a reconciled circulating-supply table across Ethereum, Cardano and BNB Chain. PeckShield’s 260 million AGIX and 53.838 million WMTx figures describe unauthorized Ethereum minting linked to the cluster rather than tokens already sold, and Bitquery’s 2.3 billion-unit estimate spans additional tickers and chains.
Until those two datasets are reconciled against official contract states, headline dollar-loss figures should be read as the sum of minted inventory plus FET drained, and not as realized proceeds.
Investigations continue. Users have been advised to ignore unsolicited recovery messages and to rely only on the official Fetch.ai, World Mobile, and SingularityNET channels for updates.
Also Read: Nostra Halts Starknet Money Market After $3.5M NSTR Oracle Exploit
