Highlights
- The same attacker hit Fetch.ai and NuNet within hours of each other on September 19, 2026, according to security firm PeckShield.
- 8.7 million FET tokens (about $1.53 million) were drained from a Fetch.ai token converter contract.
- 408.5 million NTX tokens (about $463,000) were minted without authorization through NuNet's deployer account.
- NTX's price crashed roughly 65% to 70% after the exploit went public, while FET fell about 10%.
- The attacker converted a large share of the stolen funds into 546.36 ETH, worth roughly $1.44 million.
Fetch.ai and NuNet, two separate crypto projects built around artificial intelligence infrastructure, were exploited by what security researchers describe as the same attacker in a coordinated pair of incidents on September 19, 2026. PeckShield first flagged the activity, tracking roughly 8.7 million FET tokens, worth about $1.53 million, draining out of a token converter contract tied to Fetch.ai.
The same wallet that received those stolen FET tokens then turned up on the other side of the attack. Hours later, it was used to mint 408.5 million NTX tokens directly through NuNet's deployer account, a mechanism that let the attacker create new tokens without going through the normal issuance process. Those unauthorized NTX tokens were worth roughly $462,700 at the time of minting, bringing the combined loss across both projects to close to $2 million.
Both projects sit inside the same corner of the AI-crypto ecosystem. Fetch.ai, a Cambridge-founded AI agent platform launched in 2017, merged its token with SingularityNET and Ocean Protocol in March 2024 to form the Artificial Superintelligence Alliance, with FET serving as the alliance's anchor token. NuNet operates a decentralized edge compute network whose infrastructure is being folded into the alliance's broader Hyperon node architecture, making it a close technical neighbor of Fetch.ai rather than an unrelated project the attacker happened to pick twice. That overlap likely explains why the same wallet was able to move from draining one project's contract to minting tokens on the other within the space of a single attack.
The market reaction was immediate and lopsided. NTX, the smaller and more thinly traded of the two tokens, crashed by roughly 65% to 70% as news of the unauthorized minting spread and holders rushed to exit before further dilution. FET held up considerably better, slipping only around 10%, reflecting its deeper liquidity and the fact that the Fetch.ai side of the attack involved draining existing tokens from a contract rather than minting new supply out of thin air.
On-chain trackers watched the attacker move quickly to convert a large portion of the stolen assets, exchanging them for 546.36 ETH worth approximately $1.44 million, a common tactic among exploiters looking to consolidate stolen funds into a more liquid, harder-to-freeze asset before attempting to launder them through mixers or cross-chain bridges.
Related: ZachXBT Accuses Zcash NFT Project zkSNARKs of $17M 'Money Grab'
The attack lands at an uncomfortable moment for the AI-crypto crossover trade, a corner of the market that has drawn heavy speculative interest but also, increasingly, heavy criminal attention. It follows a pattern already visible in a wave of fake AI trading bot tutorials on YouTube that drained hundreds of victims, and in the broader campaign detailed in a joint government investigation into North Korea's WaterPlum hackers, who specifically posed as recruiters at AI and crypto firms to plant malware on developers' machines. Whether or not the Fetch.ai and NuNet exploit turns out to be state-linked, it reinforces the same lesson: projects marketing themselves around AI narratives are becoming a preferred target precisely because of the hype and capital they have attracted.
Neither Fetch.ai nor NuNet had published a detailed post-mortem at the time of writing, and it remains unclear whether the exploited converter contract and deployer account shared a common vulnerability or were compromised through unrelated means. The episode adds to a string of recent security incidents that have rattled confidence in smaller altcoin projects even as broader market moves, such as the sharp gains tracked in large token rallies elsewhere in the altcoin market, show that risk appetite for the sector overall has not disappeared.
