Security researchers identified a coordinated set of attacks that drained funds and minted unauthorized tokens from Fetch.ai and NuNet, two projects focused on artificial intelligence and decentralized computing. The incidents, which unfolded within hours of each other, resulted in combined losses approaching $2 million and triggered steep declines in the affected tokens.

Details of the Dual Exploit

Blockchain security firm Blockaid reported that one attacker used a single wallet to target both protocols. On the Fetch.ai side, the attacker drained approximately 8.7 million FET tokens, valued between $1.53 million and $1.56 million at the time, from the TokenConversionManagerV3 contract on Ethereum. The method involved a valid conversion-authorizer signature that allowed a call to the conversionIn function, releasing the converter’s remaining FET inventory in one transaction.

Researchers described the process as relying on a weak security check that accepted a single approval without confirming whether the approved tokens had been locked or burned. After obtaining the private key associated with that signature, the attacker generated an approval and withdrew the full balance.

The same wallet then received roughly 408.5 million newly minted NTX tokens from NuNet’s deployer account. Those tokens were valued at about $452,000 to $463,000. The shared destination address linked both events to one operator. Blockaid publicly listed the exploiter’s wallet addresses, including the primary one beginning 0x1572, along with an example transaction to help exchanges and other projects monitor further activity.

Rapid Conversion of Stolen Assets

PeckShieldAlert noted that the attacker moved quickly to swap a substantial portion of the stolen funds into 546.36 ETH, worth roughly $1.44 million. Converting the proceeds into a more liquid asset is a frequent step that complicates efforts to trace or freeze the funds.

Market Reaction and Token Price Moves

NuNet’s NTX token experienced the more severe impact. Different trackers recorded declines ranging from 65 percent to more than 70 percent, with one report citing a 95.7 percent drop from around $0.0013 to $0.00005559. The token reached an all-time low near $0.000328 before trading around $0.0004. Trading volume rose more than 130 percent amid the sell-off, yet the increased activity failed to stabilize the price.

Fetch.ai’s FET token declined more modestly, falling between 5 percent and 10 percent. Prior to the incident, FET had risen nearly 27 percent over three days to about $0.1889 before retreating to roughly $0.1711. Because the attacker transferred existing FET rather than minting new supply, the dilution effect remained limited compared with the large unauthorized issuance of NTX. The FET decline also occurred against a broader market downturn in which total cryptocurrency capitalization fell about 4 percent.

The 8.7 million FET removed represented approximately 0.038 percent of circulating supply. While that share is relatively small relative to daily trading volume, any remaining tokens still held by the attacker could later re-enter the market and create additional selling pressure.

Absence of Official Project Statements

As of the latest reports, neither Fetch.ai nor NuNet had issued a public statement addressing the incidents. Security researchers advised holders of tokens from either ecosystem to exercise caution until the teams confirm the status of their platforms and any remedial steps taken.

Context of Wider DeFi Losses

The attacks occurred during a month already marked by significant decentralized finance losses. Before these events, DefiLlama data showed roughly $331 million lost across 17 incidents in September 2026, including a large $320 million event tied to the Liquid Network. Adding the Fetch.ai and NuNet losses pushed the monthly total above $333 million across 18 incidents. Three days earlier, the Starknet-based lending protocol Nostra had lost $3.5 million in an oracle manipulation attack.

Analysts tracking the period noted that several of the larger losses involved failures in authorization or validation processes rather than purely code-level bugs. In this case, the use of a valid but improperly controlled signature allowed the attacker to empty a token converter and trigger unauthorized minting on a separate project.

Blockaid and PeckShield continue to monitor the wallet addresses associated with the activity. Further details on the origin of the authorization credentials used in the Fetch.ai transaction have not been disclosed.