Rekt - SingularityNET - Rekt

What it is

On 19 September 2026 an attacker used signing authority exposed through a breach of SingularityNET's cloud infrastructure to drain the Ethereum FET converter and mint AGIX, NTX, WMTX and CGV. Rekt's reconstruction, which draws on Bitquery, SlowMist, PeckShield and an ASI Alliance forensic report by Athena, puts gross liquid proceeds at about $2.29M. Early alerts valued the attacker's holdings at $16.77M by marking unsold, freshly minted tokens at quoted prices.

How it works

The Ethereum bridge contracts do not verify the Cardano burn. They accept a signature from a configured authorizer as proof it happened. Bitquery counted five authorizer addresses across the affected bridges, none of which had ever sent a transaction, so the keys were used only off-chain.

Two flaws made the stolen signature worse:

• conversionIn() relied on one EOA signature and omitted the checkLimits(amount) call that conversionOut() uses. The 100 to 1,000,000 FET limits did not apply, so an 8,721,530.40 FET release (8.7 times the stated maximum) went through.
• The authorizer on the drain signature had not changed since the converter's September 2024 deployment, per the Athena report.

NTX took a different route. An address holding NuNet's mint role called mint() directly on the token contract, creating 408.5M NTX with no converter involved.

The mint timeline (UTC):

• 20:21 on 19 September: FET drain, swapped to 522.78 ETH within 2 minutes 24 seconds.
• 20:50: NTX mint.
• 03:13 to 04:21: AGIX mints in 10M batches, with WMTX from 03:38.
• 04:34 to 04:38: CGV, 50 mint calls.

WMTX's converter had a per-call limit, which only forced 503 calls. At 13:10 UTC on 20 September a payout contract also sent its 289,575.10 USDC balance to a wallet swept in the compromise.

Preconditions / Affected

• Affected: the FET converter, and the AGIX, NTX, WMTX and CGV mint paths. Fetch.ai says its contracts were not affected.
• Bitquery reported 16 wallets swept over 21 minutes before any minting. Four carried SingularityNET or NuNet staff labels, including the 2022 converter deployer.
• Rescue depended on ownership. A recovery address changed authorizers on the NuNet, Cogito and Rejuve converters and froze NTX. The AGIX and WMTX converters were owned by a Gnosis Safe and a 3-of-4 Safe, so minting ran about another hour while handovers went through.

What to do

The page gives no remediation commands. Its stated detection signal is that all 100 legitimate ConversionIn events used UUID-style IDs from SingularityNET's backend. The drain used raw non-ASCII bytes and was the only exception.

SingularityNET says it revoked compromised access, deactivated the affected bridges and conversion contracts, and paused AGIX and NTX transfers on Ethereum. The bridges stay offline until an independent security review clears them. It will retire legacy AGIX and issue a replacement, with eligibility and distribution unannounced.

Caveats

• How the attacker got into the cloud infrastructure is not public, and no full post-mortem or promised ASI Alliance report had appeared as of the page's writing.
• The $2.29M figure covers receipts through 22 September: about 742.7 ETH-equivalent and $362,075 in stablecoins. It is gross, not net profit, and excludes unsold tokens. The ASI Alliance itself acknowledged $1.56M in FET withdrawn.
• Bitquery found three of five authorizer keys unchanged on 20 September, so the restored-bridge claim is untested.
• About 40M unauthorized NTX reached Cardano liquidity pools, where they cannot be told apart from valid NTX.
• Bitquery measured unauthorized mints at 70.1% of AGIX, 81.1% of CGV, 32.4% of WMTX and 29.0% of NTX supply.
• Laundering ran through Chainflip, Baltex and THORChain (about 3.28 BTC reported by AMLBot). As of 25 September the hub wallet held about 433 ETH, and the two principal wallets held large unsold token balances.