Blockaid, a blockchain security firm, detected an active exploit involving Fetch.ai’s Ethereum-based token converter and a subsequent unauthorized mint from the NuNet deployer account on September 19, 2026. Combined identified exposure reached approximately $2.01 million, according to the firm’s initial alert posted at 21:40 UTC.
Fetch.ai is an artificial intelligence agent platform that anchors the Artificial Superintelligence (ASI) Alliance, while NuNet is a decentralized computing framework in the same ecosystem, with its NuNet Token (NTX) used to settle compute payments.
Blockaid’s public alert listed three cluster addresses linked to the activity and provided the primary exploit transactions. Blockchain security firm PeckShield later refined the figures, reporting that the attack cluster drained 8.7 million FET worth about $1.53 million from the TokenConversionManagerV3 contract, and received 408.5 million newly minted NTX tokens valued at about $462,730. The same cluster then swapped a portion of the proceeds into 546.36 ETH, worth close to $1.44 million at the time.
Show
On-Chain Timeline and Primary Transactions
The FET drain occurred at 20:21:47 UTC on September 19, 2026, in block 26013913. The transaction called the conversionIn function on the TokenConversionManagerV3 contract at address 0xab424A430CC09864fA1277A38193111705ADF3A3 and moved 8,721,530.40 FET from the converter to the wallet 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE. The initiating address was 0x1572F2af7696b39c85E3221CDE8EFb640F86c362.
Twenty-eight minutes later, at 20:50:11 UTC, the NuNet deployer account 0x863F13e5B505f1Eb17803b94EC9d3DaF80092165 executed a mint of 408.53 million NTX on the NTX token contract at 0xF0d33BeDa4d734C72684b5f9abBEbf715D0a7935 and sent the newly minted supply to the same cluster address, 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE. The reuse of the same recipient wallet is what links the two events to a single actor, according to Blockaid’s on-chain analysis.
The TokenConversionManagerV3 contract is the verified Ethereum-side converter used by the ASI Alliance for FET conversion transactions authorized by signed data. The underlying cause of the incident, including whether the attacker obtained a valid authorization signature or exploited an unrelated failure in the surrounding infrastructure, has not been publicly established at the time of publication.
Market Response and Exchange Action
FET traded near $0.18 at the time of the drain and was quoted around $0.172 on September 20, 2026, down roughly 5% over 24 hours. NTX fell sharply as the newly minted supply reached the market, with trackers reporting declines of between 65% and more than 90%. Prices dropped from about $0.00133 to well below $0.0001 in the hours following the mint.
Cryptocurrency exchange Bitget announced it would suspend FET deposits and withdrawals starting at 06:00 UTC+8 on September 20, 2026, citing wallet maintenance. Spot trading was to remain open, and a resumption time was not specified in the notice.
As of 04:36 UTC on September 20, 2026, neither Fetch.ai nor NuNet had issued an official statement on X regarding the incident. Fetch.ai’s most recent post before the exploit, published the morning of September 19, concerned ASI:One personalization features and did not reference the converter contract.
Context: A Busy September for Blockchain Security
The Fetch.ai and NuNet incident lands in the middle of a heavy month for blockchain security disclosures. Blockaid also flagged the FlamingoFinance contract exploit on September 16, in which an attacker used an $18 million USDT flash loan to extract approximately $345,900.
Earlier that day, custodial wallet provider Blink Wallet paused services after an attack on custodial accounts. Separately, Nostra halted its Starknet money market on September 17 after a $3.5 million oracle exploit involving the NSTR token.
Security researchers have flagged the three cluster addresses for exchanges and other projects, and on-chain monitors continue to track the cluster for further conversions or mints. Users holding FET or NTX have been advised to follow official channels for any contract pauses or recovery updates.
Also Read: Nostra Halts Starknet Money Market After $3.5M NSTR Oracle Exploit