Over the past seven days, two tokens in the same ecosystem lost wildly different amounts of value β and the gap tells you more about crypto than the hack itself.
NuNet's NTX fell more than 70% in a single session, printing an all-time low of $0.000328. Fetch.ai's FET fell about 5%. Same attacker. Same wallet cluster. Same September afternoon.
One protocol bled out. The other barely flinched.
That asymmetry is the story. Not the vulnerability β the vulnerability was almost embarrassingly simple. The story is why a roughly $2.01 million exploit could gut one asset and leave its sibling standing. And the answer isn't in the smart contracts. It's in the keys.
I've watched enough post-mortems land in my inbox at 3 a.m. Tallinn time to know that the sentence that matters is never in the technical disclosure. It's in the line nobody writes: who held the permission, and why did nobody ask.
Fetch.ai and NuNet are both part of the ASI Alliance β the sprawling merger of AI-and-crypto projects that includes SingularityNET and Ocean Protocol. Fetch.ai positions itself around autonomous agents and token conversion infrastructure. NuNet sells itself as a decentralized compute network, renting idle machines to workloads that need them.
On paper, both are infrastructure. In practice, both relied on a single point of trust that had nothing to do with decentralization.
Both projects sit inside a narrative that has been one of the strongest of the cycle: AI plus crypto. Fetch.ai's agents, NuNet's compute markets, SingularityNET's model layer β the pitch is that autonomous machines will transact and settle without humans in the loop. That pitch requires infrastructure you never have to think about. September has been a brutal month for that assumption. Across the month, 17 separate incidents drained more than $333 million from DeFi and adjacent protocols.
The Fetch.ai incident centered on a contract called TokenConversionManagerV3 β a converter that holds FET inventory and moves it between representations. The NuNet incident was different in kind: a large NTX mint executed from the deployer account itself.
Two mechanisms. One attacker.
According to SlowMist, the Fetch.ai conversionIn() function relied entirely on a single EOA's ECDSA signature as its only authorization check. No on-chain state verification. No multi-signature. No threshold scheme. And critically, no checkLimits(amount) modifier β the one that exists on conversionOut().
That last detail is the one that should make you sit up. Someone wrote a limit check on the way out and forgot it on the way in. This isn't an exotic zero-day. This is a code review that stopped one function too early.
Blockaid reported that a single call drained the remaining FET inventory held in the converter. One transaction. No rate limit, no daily cap, no circuit breaker.
Meanwhile, on NuNet, the attacker minted NTX from the deployer account β roughly $452,000 in value at the time. That's not a broken function. That's a stolen key, or an abused one, doing exactly what it was designed to do.
By the time PeckShieldAlert and others started tracing, the funds had been swapped into 546.36 ETH, worth about $1.44 million at reporting.
Let me walk through what actually happened on-chain, because the details matter more than the headline.
Let me be precise about what "single EOA" means, because it's the kind of phrase that slides past readers. An externally owned account is a wallet controlled by one private key. Not a multi-sig contract. Not a threshold signature. Not a role-gated module with a timelock. One key, held somewhere, by someone. Whoever had that key had the entire converter.
The converter contract held FET inventory. That inventory existed so users could convert between token representations without touching a centralized exchange. The conversionOut() path β the one users hit when withdrawing β had a limits check. The conversionIn() path did not.
Security asymmetry between sibling functions is one of the oldest and most reliable failure modes in contract design. A developer patches one path after an audit finding, ships the fix, and never audits the twin. The checklist gets marked green. The other door stays open.
Whoever held the signing key for that single EOA could authorize any inbound conversion. There's no observable evidence in the reporting of a timelock, a role separation, or a governance gate. The signature was the whole security model.
Now here's where I have to be honest about what the reporting doesn't say. There's no disclosed audit, no disclosed timelock, no disclosed permission architecture beyond the single-signer fact itself. I'm inferring from absence, and absence is not proof. But in my experience auditing converter and bridge contracts, a team that ships a checkLimits() on one function and not another is a team without a second pair of eyes in the review loop.
The NuNet side is a different animal entirely, and this is where most coverage has been lazy. Calling both events "smart contract exploits" flattens two distinct root causes into one. Fetch.ai was a logic gap. NuNet was a permission compromise.
A deployer account with mint authority is a central bank wearing a decentralized costume. If that key leaks, the attacker doesn't need to find a bug. They mint. The supply expands, the holder base is diluted instantly, and the attacker sells into whatever liquidity exists.
That is exactly the shape of a 70% drawdown that prints an all-time low. The NTX price collapsed because supply appeared and demand vanished at the same time. On-chain, the sequence is almost certainly trackable: mint, move, swap, sell. The $0.000328 low isn't a valuation. It's a liquidation cascade in a thin order book.
Compare FET. The stolen asset was protocol-owned inventory, not newly minted supply. The circulating count didn't change. The token lost about 5% while the broader market lost 4%. Fetch.ai didn't fall because of the hack. It fell because everything fell, plus a rounding error of panic.
There's a market-structure detail worth noting for anyone holding AI-sector tokens. The smart money didn't sell FET on this news. Volume in FET stayed broadly in line with the market's own drawdown. The smart money sold NTX β hard, fast, and into a book that couldn't absorb it.
That's the tell. The market looked at a converter contract that got drained and shrugged. The market looked at a deployer mint and ran. The price isn't wrong. It's just not saying.
I didn't need to see a post-mortem to know which token the market trusted.
Same attacker. Same ecosystem. Two completely different verdicts from the same crowd.
What connects them is the wallet cluster β the attacker address 0x1572β¦c362. One actor, access to two separate permission systems inside one alliance. You don't get that by guessing private keys twice. You get that by attacking the humans, the operations, or the shared dependency between them.
In my five years of trading these cycles, I've learned that "audited" and "safe" are different words. The exploit that kills a protocol is rarely the one in the report. It's the key management nobody wrote down.
NuNet's broader problem is structural, and the market already knows it. A compute network whose token can be minted by a deployer account is not decentralized in the way its narrative implies. It's centralized operations with a token incentive layered on top. That's not a crime, but it's a disclosure problem β and when the disclosure gap meets a security event, the repricing is violent.
The negative feedback loop is the part most people miss. NTX down 70% means node operators earn less for the same work. Operators leave. Compute supply shrinks. The network gets weaker. The token gets weaker. Rinse.
Here's where I'll push against the consensus read.
The prevailing narrative is that this was a security failure. I think it was a governance failure that happened to have a security symptom. Every detail points to the same conclusion: the projects in question had permission structures inconsistent with what they told the market about themselves.
The industry has spent a decade building clever cryptography and almost no time building boring permission hygiene. Multi-sig is not exciting. Timelocks are not a narrative. Key rotation schedules will never trend on social media. So they get skipped β until a single ECDSA signature becomes the only wall between a converter's inventory and a stranger's wallet.
And the second consensus that deserves scrutiny: that small incidents don't matter because the numbers are small. Two million dollars is noise in this market. But the mechanism here isn't small. It's the same mechanism that emptied Terra. It's the same mechanism behind every "trusted setup" that wasn't.
Every crash is just a story that hasn't found its ending yet.
The DeFi winter taught us something we keep forgetting: the protocols that survive aren't the ones with the cleverest tokenomics. They're the ones whose operators assumed they'd be attacked from the inside.
What I'm watching now, in order: whether NuNet rotates the deployer key and sets a mint cap within 72 hours, whether the 546.36 ETH moves toward a mixer or a CEX, and whether the same wallet cluster appears against another ASI Alliance member.
If the responder's first instinct is a blog post instead of a key rotation, the NTX low of $0.000328 won't be the low.
In the DeFi winter, we didn't ask who held the mint key. We're asking now. It's late, but it's not nothing.
