Security Breach in Cryptocurrency
In a remarkable breach of security within the cryptocurrency sphere, a hacker executed simultaneous attacks on two separate projects over the weekend, resulting in a staggering theft valued at approximately $2.01 million. Authorities reported that the attacker drained 8.72 million FET from a converter associated with Fetch.ai and minted an extraordinary 408.5 million NTX at Nunet. Notably, this minting act represented around 42% of the entire NTX token supply, leading to an immediate and severe destabilization of its market.
Details of the Attack
The assault, which took place late Saturday night into early Sunday, involved the manipulation of cryptographic keys that authorized transactions across these two blockchain projects. The scale of the attack was unnerving: Fetch.ai saw FET tokens worth roughly $1.55 million vanish, while the attack on Nunet allowed the hacker to create new NTX tokens valued between $452,000 and $463,000 at the time.
Experts from Peckshield, Blockaid, and Fetch.ai collaborated and traced the activity back to the same wallet cluster, revealing the coordinated nature of the heist. The hack of Fetch.ai’s TokenConversionManagerV3 contract was not a result of exploiting a mathematical vulnerability, but rather an issue with how authorization signatures were implemented. It was found that the conversion function lacked critical checks which typically ensure that tokens are accounted for securely. This loophole allowed the attacker to craft legitimate transaction instructions that redirected the stolen FET to their address swiftly.
Implications of the Hack
The compromised signing key was linked to SingularityNET’s cross-chain bridge, inferring that the origin of the attack may stem from a breach in their protocols. At the same time, the attacker also exploited a separate minting key associated with NTX, indicating a synchronized multi-faceted assault. Despite the chaotic nature of the events, Fetch.ai reported no damage to its treasury funds or to any user assets held in secure custody outside of the affected wallets.
The repercussions of the NTX minting were particularly acute—leading to a dramatic devaluation of the token. Prior to the hack, NTX was trading at approximately $0.0013, but reports indicated a market plunge of more than 70%, with values dropping to under $0.000328 as liquidity evaporated. Some exchanges noted losses in trading prices as severe as 96% to 99%. In comparison, FET’s value declined by a much smaller margin, between 5% and 8%, due to the nature of the theft.
Aftermath and Response
After the breach, it was revealed that the attacker, through the same wallet cluster, converted stolen assets into roughly 546.36 ETH, which was worth about $1.44 million at the time. Additionally, a portion of the minted NTX appeared to remain unsold when Fetch.ai released its preliminary report, meaning the market was facing the threat of excessive, untraded tokens further undermining the value.
In response to this alarming situation, Fetch.ai has taken measures to disable the affected wallets and contracts, urging their users to be cautious of unsolicited communications and to utilize official sources for information. Investigators have made progress in understanding the mechanics of the attacks, yet the precise details regarding how the key credentials fell into the attacker’s hands remain unknown, with multiple theories from phishing to server intrusions being examined.
Conclusion
This incident underscores the vulnerabilities that can exist within cryptocurrency infrastructure and raises critical questions about security practices in the sector. Clearly, as seen in this case where valid signatures were exploited to execute unauthorized operations, the potential for significant financial losses is ever-present in the rapidly evolving world of blockchain technology.
