A coordinated attack on two artificial intelligence-focused blockchain projects resulted in approximately $2 million in stolen and minted tokens on September 19, 2026. Security researchers at PeckShield and Blockaid traced the Fetch.ai exploit and a subsequent NuNet token mint to the same wallet address, revealing a vulnerability in how token conversion contracts handle authorization checks.

What Happened in the Fetch.ai and NuNet Attacks?

The attacker drained 8.7 million FET tokens from Fetch.ai's token converter contract, valued at approximately $1.53 million according to PeckShield's analysis. Blockaid estimated the FET loss at $1.56 million. The same wallet then received 408.5 million NuNet (NTX) tokens that were minted without authorization by NuNet's deployer account, worth roughly $462,730 to $452,000 depending on the security firm's valuation.

The attacker converted the stolen assets into 546.36 Ethereum (ETH) tokens, equivalent to approximately $1.44 million at the time of the attack. Both Fetch.ai and NuNet operate at the intersection of blockchain technology and artificial intelligence services; Fetch.ai provides autonomous AI agent services through its Agentverse platform, while NuNet creates an open platform for sharing GPU and CPU computing resources.

How Did the Attacker Exploit These Projects?

The vulnerability centered on Fetch.ai's TokenConversionManagerV3 smart contract on the Ethereum blockchain. The attacker invoked the conversionIn function using an authorization signature, which allowed the release of remaining FET tokens from the converter. Security firm SlowMist identified the root cause: the conversionIn function relied solely on a single external account's ECDSA signature for authorization and lacked verification checks on the token amount being transferred.

"TokenConversionManagerV3's conversionIn() leaves single-EOA ECDSA signature as the sole authorization check. It lacks the checkLimits(amount) modifier present in conversionOut(), and does not verify any on-chain," SlowMist noted.

SlowMist, Security Research Team

In contrast, the outbound conversion function included protections that the inbound function lacked. However, security researchers did not publicly explain how the attacker obtained the valid signature required for the exploit, nor did they clarify how the attacker gained access to NuNet's deployer account to mint the unauthorized tokens.

What Was the Market Impact?

The price movements following the exploit were severe. NuNet's NTX token fell approximately 65% immediately after the attack became public on September 19, with some reports on September 20 showing a 24-hour decline exceeding 90%. The token hit an all-time low of $0.00005338. Fetch.ai's FET token recorded a smaller decline, though this occurred amid a broader cryptocurrency market sell-off where total market capitalization fell 4.1%.

How to Protect Against Smart Contract Exploits

• Authorization Verification: Implement comprehensive authorization checks that verify both the signature and the transaction amount, rather than relying on a single external account's signature as the sole security mechanism.
• Consistent Security Modifiers: Apply the same protective modifiers and checks across all related functions, such as checkLimits() on both inbound and outbound conversion functions, to prevent inconsistent security standards.
• Access Control Review: Regularly audit and restrict access to deployer accounts and sensitive contract functions, ensuring that only necessary parties can mint tokens or execute critical operations without additional verification layers.

Where Does this fit in September's Broader Security Crisis?

The Fetch.ai and NuNet exploits are part of a devastating month for cryptocurrency security. According to DefiLlama, September 2026 recorded approximately $333 million in total security losses across multiple incidents. The Liquid Network bridge hack alone accounted for $320 million on September 6, representing roughly 97% of losses recorded in the preceding days of the month.

Other significant September incidents included Nostra Money Market's $3.5 million loss due to oracle price manipulation, Nomic's $3.15 million loss from an unbacked cross-chain mint, and Chainflip's $736,442 loss attributed to a bridge logic flaw. The frequency and scale of these attacks underscore persistent vulnerabilities in how blockchain projects handle token conversions, cross-chain bridges, and access controls.

The Fetch.ai exploit highlights a critical pattern: even projects focused on advanced technologies like artificial intelligence remain vulnerable to relatively straightforward authorization flaws in their smart contracts. As the crypto industry continues to integrate AI services with blockchain infrastructure, security audits and code reviews must keep pace with the complexity of these hybrid systems.