{"id":78445,"date":"2026-09-21T05:04:41","date_gmt":"2026-09-21T05:04:41","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/one-attacker-hits-two-crypto-projects-and-walks-with-2-million\/"},"modified":"2026-09-21T05:04:41","modified_gmt":"2026-09-21T05:04:41","slug":"one-attacker-hits-two-crypto-projects-and-walks-with-2-million","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/one-attacker-hits-two-crypto-projects-and-walks-with-2-million\/","title":{"rendered":"One Attacker Hits Two Crypto Projects and Walks With $2 Million"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Fetch.ai lost 8.72 million FET after a compromised signing key opened its converter.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">NTX got hammered after 408.5 million new tokens, roughly 42% of supply, were minted.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Fetch.ai traced both attacks to the same window, but how the keys escaped is still unknown.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>One Attacker, Two Crypto Projects and $2 Million Gone<\/h2>\n<p>Late Saturday into Sunday, somebody holding the right cryptographic keys managed to hit two crypto projects almost simultaneously, turning what could have looked like unrelated exploits into one very strange $2 million heist. <a href=\"https:\/\/x.com\/Fetch_ai\/status\/2101595159054131393?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">On the Fetch.ai side<\/a>, 8,721,530 FET, worth roughly $1.55 million, disappeared from a token converter. On the other side, the attacker didn\u2019t merely steal coins already sitting somewhere.<\/p>\n<p><\/p>\n<p>They created about 408.5 million new NTX, worth roughly $452,000 to $463,000 at the time. That mint represented about 42% of NTX\u2019s supply. Peckshield, Blockaid and Fetch.ai <a href=\"https:\/\/x.com\/PeckShieldAlert\/status\/2101457227379044822?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">ultimately connected the activity<\/a> to the same wallet cluster.<\/p>\n<h2>One Signature Opened the FET Vault<\/h2>\n<p><a href=\"https:\/\/x.com\/SlowMist_Team\/status\/2101503515877396639?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">The latest FET theft<\/a> wasn\u2019t a case of somebody discovering a clever mathematical flaw and hammering a smart contract. Fetch.ai\u2019s TokenConversionManagerV3 contract accepted a valid conversion-authorizer signature through its conversionIn()function. The problem was that this signature was essentially the gatekeeper. Unlike conversionOut(), the function didn\u2019t run the checkLimits(amount) modifier, nor did it verify onchain that corresponding tokens had been locked or burned elsewhere.<\/p>\n<p>Once the signing key was compromised, the attacker could create a fresh valid message pointing to their own address. One transaction later, the converter\u2019s remaining FET inventory was gone. Fetch.ai\u2019s preliminary review traced the compromised credential to a backend signing key used by SingularityNET\u2019s cross-chain bridge. A separate NTX minting key was compromised as well, with Fetch.ai saying both attack paths began in the same minute.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-849105\" src=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/screenshot-2026-09-20-at-9-01-43-am.png\" alt=\"\" width=\"1336\" height=\"490\" srcset=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/screenshot-2026-09-20-at-9-01-43-am-300x110.png 300w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/screenshot-2026-09-20-at-9-01-43-am-1024x376.png 1024w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/screenshot-2026-09-20-at-9-01-43-am-768x282.png 768w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/screenshot-2026-09-20-at-9-01-43-am.png 1336w\" sizes=\"auto, (max-width: 1336px) 100vw, 1336px\"\/><\/p>\n<p>That timing is where the story gets stranger. These weren\u2019t simply two projects <a href=\"https:\/\/news.bitcoin.com\/security\/blink-wallet-hit-by-attacker-few-dozen-custodial-accounts-drained\/\">having bad weekends<\/a> at once. The same operator appears to have obtained credentials capable of authorizing transactions across connected infrastructure, then used them almost simultaneously.<\/p>\n<h2>408.5 Million Tokens Appeared From Thin Air<\/h2>\n<p>The NTX side was considerably more destructive to the token itself. Instead of draining a finite wallet, the attacker gained the ability to create new coins. Roughly 408.5 million NTX suddenly entered the equation, equivalent to about 42% of supply.<\/p>\n<p>Put another way, for every 10 NTX already represented in the supply, the attacker had suddenly created the equivalent of roughly four more.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-849107\" src=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/ntxusdt_2026-09-20_09-06-52.png\" alt=\"\" width=\"1996\" height=\"1028\" srcset=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/ntxusdt_2026-09-20_09-06-52-300x155.png 300w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/ntxusdt_2026-09-20_09-06-52-1024x527.png 1024w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/ntxusdt_2026-09-20_09-06-52-768x396.png 768w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/ntxusdt_2026-09-20_09-06-52-1536x791.png 1536w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/ntxusdt_2026-09-20_09-06-52.png 1996w\" sizes=\"auto, (max-width: 1996px) 100vw, 1996px\"\/><\/p>\n<p>That\u2019s a brutal problem for a thinly traded token. <a href=\"https:\/\/www.tradingview.com\/symbols\/NTXUSDT\/?exchange=MEXC\" target=\"_blank\" rel=\"noopener noreferrer\">The NTX exchange rate<\/a> had been sitting near $0.0013 before the incident. Market data showed it falling more than 70% and touching a $0.000328 low, while later feeds printed even lower prices as liquidity deteriorated. Some trackers recorded declines of 96% to 99%, though exact prices varied sharply between venues because the market was so thin.<\/p>\n<p>FET took a very different punch. Its circulating supply didn\u2019t suddenly balloon because the attacker stole existing inventory from a converter. <a href=\"https:\/\/www.tradingview.com\/symbols\/FETUSDT\/?exchange=BINANCE\" target=\"_blank\" rel=\"noopener noreferrer\">FET fell roughly 5% to 8%<\/a> across several feeds, painful but nowhere near NTX\u2019s collapse.<\/p>\n<h2>The Loot Quickly Became ETH<\/h2>\n<p>The attacker didn\u2019t simply leave the stolen assets sitting around. PeckShield tracked the wallet cluster swapping proceeds into 546.36 ETH, worth roughly $1.44 million at the time. Fetch.ai\u2019s later snapshot showed about 547.89 ETH alongside approximately 230 million NTX still sitting in one wallet.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-849108\" src=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/fetusdt_2026-09-20_09-07-14.png\" alt=\"\" width=\"1996\" height=\"1028\" srcset=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/fetusdt_2026-09-20_09-07-14-300x155.png 300w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/fetusdt_2026-09-20_09-07-14-1024x527.png 1024w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/fetusdt_2026-09-20_09-07-14-768x396.png 768w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/fetusdt_2026-09-20_09-07-14-1536x791.png 1536w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/09\/fetusdt_2026-09-20_09-07-14.png 1996w\" sizes=\"auto, (max-width: 1996px) 100vw, 1996px\"\/><\/p>\n<p>That remaining NTX matters because a large chunk of the newly minted supply apparently hadn\u2019t been sold when Fetch.ai published its initial analysis. The market, therefore, had to contend not only with coins already dumped but with hundreds of millions more potentially hanging over thin order books.<\/p>\n<p>Fetch.ai said treasury funds, exchange wallets, and user coins held in self-custody or on exchanges weren\u2019t affected. <a href=\"https:\/\/x.com\/Fetch_ai\/status\/2101595159054131393?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">The team began working<\/a> with SingularityNET to disable the affected wallets and contracts while warning users to ignore unsolicited messages and rely on official channels.<\/p>\n<h2>The Missing Answer Is How the Keys Escaped<\/h2>\n<p>Investigators have explained the machinery of the attack far better than its origin. SlowMist detailed how the FET converter accepted the compromised signature, while Fetch.ai identified the SingularityNET bridge signer and NTX minting key involved. What nobody has publicly established is how those credentials were compromised in the first place.<\/p>\n<p>There\u2019s no confirmed public answer yet showing whether phishing, a server intrusion, a leaked backup or something else put the keys in the attacker\u2019s hands. There are also hundreds of millions of newly minted NTX still to account for, along with the question of whether exchanges can freeze labeled funds or the extra supply can somehow be neutralized.<\/p>\n<p>The blockchain did exactly what the valid signatures told it to do. That may be the strangest part of the whole episode. FET bent. NTX broke.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/one-attacker-hits-two-crypto-projects-and-walks-with-2-million\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Fetch.ai lost 8.72 million FET after a compromised signing key opened its converter. NTX got hammered after 408.5 million new tokens, roughly 42% of supply, were minted. Fetch.ai traced both attacks to the same window, but how the keys escaped is still unknown. One Attacker, Two [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":78446,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78445"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78445"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78445\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78446"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}