Artificial Superintelligence Alliance exploit analysis

A coordinated exploit against the three projects of the Artificial Superintelligence Alliance (Fetch.ai, NuNet, and SingularityNET) used privileged keys held by the alliance to mint and drain assets across all three in a single weekend. The alliance markets itself as a group of crypto projects dedicated to decentralized artificial general intelligence, sharing bridges and token converters across the three members.

The attacker began with Fetch.ai, pulling roughly 8.7 million FET from the project's TokenConversionManagerV3 contract on Ethereum. Almost in the same window, the same address received about 408.5 million freshly minted NTX from a NuNet deployer account, a sum that represented around 42% of NTX's circulating supply and crashed the token between 65% and more than 90% within hours. Hours later, the SingularityNET side of the alliance was hit, with 900 million AGIX, 500 million WMTx (World Mobile Chain), and 500 million CGV (Cogito) minted out of thin air.

The mechanism in each case was the same. Keys belonging to the alliance's shared infrastructure were used to authorise or perform the unauthorised actions, not a smart contract bug. Blockchain analyst firm Bitquery later flagged an earlier sweep of ETH and BNB from sixteen wallets, four of which it had previously labelled as SingularityNET or NuNet staff wallets, and warned that the majority of the signing keys involved had not been rotated. After the initial theft, $289,575 in USDC was drained from a payroll contract associated with the alliance.

The realised profit was a small fraction of the notional value. Selling the genuine FET for 523 ETH returned the largest share, with the four minted tokens together bringing in only 183 ETH. The half billion CGV tokens were essentially worthless on the open market. PeckShield, the auditor that first flagged the third incident, put the attacker's still-unrealised holdings at about $16.77 million, including 198.3 million AGIX and 649 ETH. No funds have been recovered and no attacker has been identified.

Fetch.ai said its own contracts were unaffected, with the loss coming through the FET token migration and bridge architecture operated under the alliance banner. The alliance confirmed the exploit publicly but has not yet named a vector or replaced most of the compromised keys. Token prices of the minted assets collapsed as the counterfeit supply entered circulation, with NTX losing 65% to more than 90% of its value within hours, while the sale of the genuine FET knocked about 5% off its market price.