SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted
SingularityNET / ASI Alliance bridge and conversion contracts (also NuNet, Cogito, Rejuve and World Mobile tokens)
An unauthorized party got into part of SingularityNET's cloud infrastructure and on 19-20 September 2026 used a compromised authorizer signature and NuNet's mint authority to release 8.72M FET from a bridge and mint about 2.3 billion AGIX, NTX, WMTX and CGV. Sixteen wallets, four labelled as SingularityNET or NuNet staff, were swept before the minting. Headlines cited $16.77M, but Rekt's transaction-level count found about $2.29M in sellable proceeds because most minted tokens could not be sold. Bridges and converters are offline and AGIX is being replaced, so holders should wait for official migration steps.
Why this severity: $2.3M reported stolen, only partly contained.
- Started
- Sep 19, 2026
- Reported stolen
- $2.3M
Indicators · never visit or send to these
- 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe
- 0x83f4424a401a9bb75f90314f21adaea6a9ce09c5
What to do now
- Don't buy or swap the affected tokens on DEXs until the projects publish official migration details; prices of freshly minted supply can collapse.
- Only follow migration steps posted on SingularityNET's official channels. Treat 'claim your replacement token' links in replies and DMs as phishing.
Stay safe
Am I affected?
If you hold AGIX, NTX, WMTX or CGV, or had tokens moving through SingularityNET's bridges or converters, your tokens may be affected by the pause and the AGIX replacement.
What to do now
- Don't buy or swap the affected tokens on DEXs until the projects publish official migration details; prices of freshly minted supply can collapse.
- Only follow migration steps posted on SingularityNET's official channels. Treat 'claim your replacement token' links in replies and DMs as phishing.
How to avoid this
- For teams: keep bridge signing keys in hardware security modules, require several independent signers, and apply the same limits to inbound and outbound conversions.
- For users: prefer bridges with multi-party verification and rate limits, and don't leave tokens sitting in bridge contracts.
Timeline 3
Rekt reported SingularityNET had revoked the access, shut the bridges and converters, paused AGIX and NTX transfers on Ethereum and planned to retire AGIX; the attacker's hub still held about 433 ETH.
SourceUnauthorized minting began around 03:13 UTC, creating about 2.3 billion AGIX, NTX, WMTX and CGV.
SourceA compromised authorizer signature released 8,721,530.40 FET from the bridge, cleared at 20:21 UTC, which the attacker swapped for 522.78 ETH.
Source
News & write-ups ›1
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.