Fetch.ai, NuNet, World Mobile: what the attacker sold, and the 433 ETH and 200 million WMTX he still holds

Fetch.ai, SingularityNET and NuNet belong to the ASI Alliance, and their Ethereum tokens are moved by conversion contracts that pay out whatever a trusted backend key signs. On the evening of 19 September that key signed for the attacker. At 20:21 UTC Fetch.ai’s TokenConversionManagerV3 paid 8,721,530 FET to 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE, sold three minutes later; at 20:50 NuNet’s token contract minted 408,532,878 NTX to the same address, about 42% of all NTX. Before dawn on 20 September the same keys minted SingularityNET’s AGIX and Cogito Finance’s CGV, and a WMTX conversion contract, TokenConversionManagerV2, started paying out World Mobile Token.

Every address below is surrounded by spoof tokens called "USDC" and "ETH" and by look-alike addresses sharing their first and last characters — address poisoning by third parties. Only the real token contracts are counted here.

Some reports quoted 260 million AGIX and 53.8 million WMTX. Those are the main wallet’s figures; PeckShield’s totals include both. From 03:46 UTC on 20 September a second address, 0x83F4424A401a9Bb75F90314f21ADAeA6a9cE09C5, received its own share from the same contracts: 445,139,794 WMTX from TokenConversionManagerV2 in 449 transfers, 635,962,345 AGIX and 492,397,101 CGV minted to it directly. It sends its own transactions, so it is an ordinary wallet with delegated code, not someone else’s contract.

Counted across both wallets, the attacker took 498,977,794 WMTX out of the conversion contract — a third of the 1.49 billion WMTX in existence, and about $11.9 million at $0.0238 — and 895,962,345 AGIX. The 492 million CGV is 97% of that token’s entire supply. The paper value of the AGIX and CGV is small — $0.0007 and $0.0003 a token — because selling into them destroys the price; the WMTX is different, and most of the risk to World Mobile holders sits there.

The attacker sold through MetaMask’s swap router and Uniswap: FET, most of the NTX, and part of the AGIX, WMTX and CGV came back as about 720 ETH. Of that, 293.7 ETH has left — 100 ETH and 93.7 ETH through one-hop wallets into two different deposit contracts, and 100 ETH into a contract with no history — on 20 and 21 September.

The rest has not moved. On 24 September the main wallet holds 433.05 ETH and 15.94 WETH, with 198.3 million AGIX and 33.5 million WMTX; the second holds 166.5 million WMTX, 625.9 million AGIX and 246.0 million CGV. Two hundred million WMTX in one actor’s hands is a sale waiting to happen on World Mobile holders.

Before any conversion, between 19:32 and 19:53 UTC on 19 September, the main wallet received ETH and tokens from about a dozen addresses. The largest, 0x1572F2af7696b39c85E3221CDE8EFb640F86c362, sent 24.3 million NTX and 11.09 ETH and was left empty. Bitquery reports sixteen wallets swept this way, four of them labelled as SingularityNET or NuNet staff; this one held NTX and has been active since November 2024, which fits. The attacker also took 289,575 USDC from what PeckShield describes as a payroll wallet, 0x37E550d082d115EE65db19B17dC84c67024fac40, and moved it to the second wallet. These are victims’ wallets, not the attacker’s, and are not labelled as his.

The five attacker-side addresses on this page — the two main wallets and the three exit hops — are labelled in PublicAML. The two main wallets are also watched: when the 433 ETH or the 200 million WMTX moves, this page will say where.