Fetch.ai Conversion Contract Exploited for $2.01M, Attacker Tied to NuNet
TREE NEWS reports: A conversion contract on Ethereum operated by Fetch.ai was exploited, resulting in the loss of approximately $2.01 million in crypto assets. On-chain security platform Blockaid identified the vulnerable contract as TokenConversionManagerV3, which was drained by an externally owned account (EOA) that held a valid conversion authorization. The attacker’s address has been linked to NuNet, a decentralized computing project within the Fetch.ai ecosystem.
How the Exploit Unfolded
The attacker used a legitimate conversion authorization to execute the exploit. The TokenConversionManagerV3 contract is designed to facilitate the conversion of Fetch.ai’s native FET tokens between different blockchain networks, a core piece of infrastructure for the project’s multi-chain strategy. By obtaining a valid authorization — whether through a compromised key, a phishing attack, or a flaw in the authorization logic — the attacker was able to drain funds without triggering immediate alarms.
The link to NuNet is particularly concerning. NuNet is a sister project within the Fetch.ai ecosystem that focuses on decentralized compute resources. If the attacker’s address is associated with NuNet, it could indicate an insider threat, a compromised team member, or a broader security breach that extends beyond a single contract.
Industry Implications
This incident underscores the persistent risks facing cross-chain conversion mechanisms and authorization systems in DeFi. Conversion contracts often hold significant liquidity and rely on trusted roles or off-chain signatures, making them attractive targets. The fact that the attacker used a valid authorization suggests that the exploit may have been enabled by operational security failures rather than a pure smart contract bug.
- Authorization management is critical: Projects must audit not only code but also key management, role assignments, and off-chain signing processes.
- Cross-chain bridges and converters remain high-risk: These components are frequent targets because they aggregate liquidity and often have complex trust assumptions.
- Ecosystem contagion: The NuNet connection highlights how a single compromised address can taint multiple projects within an interconnected ecosystem.
Forward-Looking Perspective
Fetch.ai has not yet issued a detailed post-mortem, but the incident is likely to accelerate calls for more robust authorization frameworks, including multi-signature requirements, time-locked conversions, and real-time monitoring by security firms like Blockaid. For the broader DeFi sector, the exploit serves as a reminder that even audited contracts can be bypassed when privileged access is misused. Investors and users should watch for further disclosures from Fetch.ai and NuNet, as well as any on-chain movement of the stolen funds, which could provide clues about the attacker’s identity and intent.
