Hacker steals $2.25M in series of bridge attacks on three AI projects

A single attacker exploited bridges belonging to Fetch.ai, NuNet, and SingularityNET over the weekend, making off with approximately $2.25 million in realized gains from stolen tokens.

Bitquery's report noted that the face value of the minted tokens was much larger at the time of the exploit. PeckShield, which first detected the third attack, estimated the unrealized profit for the hacker at nearly $17 million.

#PeckShieldAlert The same exploiter has exploited @SingularityNET, resulting in the unauthorised minting of 260M $AGIX & 53.838M $WMTx on Ethereum.

The exploiter currently holds ~$16.77M worth of crypto, including 198.3M AGIX (worth $14.42M), 649 $ETH (worth ~$1.67M), and… https://t.co/eee4cZbZhI pic.twitter.com/oHBpbWXQMj

— PeckShieldAlert (@PeckShieldAlert) September 20, 2026

Two of the three projects, all belonging to the "Artificial Superintelligence Alliance" ecosystem, experienced attacks at nearly the same time.

Initially, the hacker extracted 8.7 million FET from the Fetch.ai bridge and created 400 million NuNet NTX tokens.

Hours afterwards, the SingularityNET bridge was compromised, leading to the creation of 900 million AGIX tokens, along with 500 million WMTx from World Mobile Chain and 500 million CGV from Cogito.

Most of the attacker's profit came from selling Fetch.ai's FET for 523 ETH, roughly $1.2 million. Sales of the other four tokens together yielded only 183 ETH ($420,000).

The 500 million CGV tokens fetched merely $30 because liquidity was extremely shallow.

Since large shares of the supply now consist of newly minted fake tokens, the prices of those assets have plummeted.

In contrast, the sale of authentic FET tokens caused a 5% price decline.

Bitquery further pointed to an initial draining of ETH and BNB from 16 wallets, four of which it had earlier identified as belonging to SingularityNET or NuNet staff, suggesting deep compromise of the linked firms' infrastructure.

An additional $289,575 in USDC was subsequently taken from a payroll contract.

The report cautioned that most of the signing keys remain unchanged.