The bridge contracts did what they were told. That is the uncomfortable finding at the centre of the SingularityNET incident: forensic work cited by Digital Coin Journal points to compromised authorization keys rather than a signature-verification bypass inside the converter code. Nothing in the contract logic had to break for hundreds of millions of tokens to appear on Ethereum out of nothing.
That distinction matters for every project running the same design. SingularityNET’s converters rely on designated signing authorities to attest that tokens were burned or locked on another chain before corresponding assets are released or created. Whoever held the compromised keys could produce signatures the contracts treated as valid even when no legitimate cross-chain event had occurred. The trust anchor was operational, not cryptographic, and it moved outside the chain entirely.
Key Takeaways
- Forensic analysis attributes the SingularityNET incident to compromised signing authorities on its cross-chain converters, not a flaw in bridge contract verification.
- PeckShield reported 260 million AGIX and 53.838 million WMTx minted without authorization, and valued the attacker cluster’s holdings at roughly $16.77 million as of its September 20 snapshot.
- Bitquery later reconstructed a larger picture: 895.96 million AGIX, 500.48 million WMTx and 492.40 million CGV created through converter calls, plus 408.53 million NTX from a separately compromised NuNet mint authority.
- The same attacker cluster had previously removed 8.72 million FET from a Fetch.ai converter; Fetch.ai paused AGIX-to-FET conversions and suspended its Ethereum-side bridge contract.
- Unauthorized supply, tokens still held, tokens sold and cash extracted are different accounting categories, and the totals should not be added together as a dollar loss.
Compromised Signing Authority, Not Broken Verification
The attack path is straightforward once the keys are gone. A converter’s job is to check an attestation and act on it. With valid signing material in hand, an attacker can present a burn or lock that never happened, and the contract mints or releases accordingly. No reentrancy, no arithmetic overflow, no malformed proof.
NuNet shows the same failure in an even more direct form. Rather than routing through a converter, the attacker invoked the NTX token’s mint function through a compromised authority, creating roughly 408.53 million NTX. That is unauthorized issuance, not a drain of 408.5 million pre-existing tokens, and the difference changes what recovery looks like.
According to CryptoMoonPress, an unauthorized party accessed cloud infrastructure on September 19, and AGIX transfers were paused once the exploit was confirmed. That timeline is consistent with a credential compromise upstream of the contracts rather than an on-chain logic failure.
The Numbers Diverge Because the Snapshots Do
PeckShield’s alert covered 260 million AGIX and 53.838 million WMTx minted on Ethereum, and put the exploiter cluster’s holdings at approximately $16.77 million as of September 20. That figure broke down as roughly 198.3 million AGIX worth $14.42 million, 649 ETH worth $1.67 million, and 33.538 million WMTx worth about $627,000.
Read that as a mark-to-market snapshot of what the wallets held at one moment, not confirmed realized proceeds or an independently reconciled loss. Much of the inventory was irregularly minted token supply whose realizable value depends entirely on available liquidity, and thin books do not absorb that volume at quoted prices.
Bitquery’s later reconstruction found substantially more issuance than PeckShield’s early count: 895.96 million AGIX, 500.48 million WMTx and 492.40 million CGV generated through converter calls, alongside the 408.53 million NTX from the NuNet path. The two sets of figures are not contradictory. They capture different stages of the same event, and summing them into a headline dollar number would conflate supply created with value extracted.
Containment Focused on Revoking Authorities
World Mobile confirmed that the SingularityNET bridge had been used to create WMTx on Ethereum without authorization, contacted exchanges to freeze affected deposits, and worked with security partners to revoke minting authorities. Its response addressed the irregular supply rather than any compromise of World Mobile Chain itself.
Fetch.ai, whose converter had earlier lost 8.72 million FET to the same attacker cluster, said its own contracts were not under threat. It paused AGIX-to-FET conversions and suspended its Ethereum-side bridge contract as a precaution, characterizing SingularityNET’s Ethereum-Cardano bridge infrastructure as the principal affected area while FET continued operating normally.
What to Watch
The final scale is still under reconciliation, because trackers captured different stages of the attack. The next concrete milestones are a definitive root-cause report, reconciled cross-chain supply figures, and confirmation that the compromised signing authorities have been fully revoked before affected bridge and conversion services resume.
