{
 "slug": "singularitynet-bridge-signing-key-compromise-sep-2026",
 "title": "SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted",
 "url": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026",
 "json": "https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026.json",
 "status": "live",
 "severity": "critical",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "ethereum",
  "bsc"
 ],
 "method": "key-leak",
 "product": "SingularityNET / ASI Alliance bridge and conversion contracts (also NuNet, Cogito, Rejuve and World Mobile tokens)",
 "tags": [
  "ethereum",
  "bsc",
  "key-leak",
  "bridge",
  "cloud-compromise",
  "signing-key",
  "unauthorized-mint",
  "singularitynet",
  "asi-alliance",
  "nunet",
  "fet",
  "agix"
 ],
 "amountUsd": 2290000,
 "victims": null,
 "startedAt": "2026-09-19",
 "closedAt": null,
 "updatedAt": "2026-09-25T12:00:00Z",
 "summary": "An unauthorized party got into part of SingularityNET's cloud infrastructure and on 19-20 September 2026 used a compromised authorizer signature and NuNet's mint authority to release 8.72M FET from a bridge and mint about 2.3 billion AGIX, NTX, WMTX and CGV. Sixteen wallets, four labelled as SingularityNET or NuNet staff, were swept before the minting. Headlines cited $16.77M, but Rekt's transaction-level count found about $2.29M in sellable proceeds because most minted tokens could not be sold. Bridges and converters are offline and AGIX is being replaced, so holders should wait for official migration steps.",
 "timeline": [
  {
   "date": "2026-09-19",
   "title": "A compromised authorizer signature released 8,721,530.40 FET from the bridge, cleared at 20:21 UTC, which the attacker swapped for 522.78 ETH.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt"
  },
  {
   "date": "2026-09-20",
   "title": "Unauthorized minting began around 03:13 UTC, creating about 2.3 billion AGIX, NTX, WMTX and CGV.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt"
  },
  {
   "date": "2026-09-25",
   "title": "Rekt reported SingularityNET had revoked the access, shut the bridges and converters, paused AGIX and NTX transfers on Ethereum and planned to retire AGIX; the attacker's hub still held about 433 ETH.",
   "sourceUrl": "https://rekt.news/singularitynet-rekt"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "SingularityNET - Rekt",
   "url": "https://rekt.news/singularitynet-rekt",
   "publisher": "Rekt News",
   "date": "2026-09-25"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": [
   "0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe",
   "0x83f4424a401a9bb75f90314f21adaea6a9ce09c5"
  ]
 },
 "brief": "## Am I affected?\nIf you hold AGIX, NTX, WMTX or CGV, or had tokens moving through SingularityNET's bridges or converters, your tokens may be affected by the pause and the AGIX replacement.\n\n## What to do now\n- Don't buy or swap the affected tokens on DEXs until the projects publish official migration details; prices of freshly minted supply can collapse.\n- Only follow migration steps posted on SingularityNET's official channels. Treat 'claim your replacement token' links in replies and DMs as phishing.\n\n## How to avoid this\n- For teams: keep bridge signing keys in hardware security modules, require several independent signers, and apply the same limits to inbound and outbound conversions.\n- For users: prefer bridges with multi-party verification and rate limits, and don't leave tokens sitting in bridge contracts.",
 "notes": null,
 "agentBrief": "# SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted\n\n- Severity: Critical · Status: Partly contained (live)\n- Chains: Ethereum, BNB Chain · Method: Leaked private keys and seed phrases\n- Started: Sep 19, 2026 · Last update: Sep 25, 2026 · Reported stolen: $2.3M\n- Who/what: SingularityNET / ASI Alliance bridge and conversion contracts (also NuNet, Cogito, Rejuve and World Mobile tokens)\n\nAn unauthorized party got into part of SingularityNET's cloud infrastructure and on 19-20 September 2026 used a compromised authorizer signature and NuNet's mint authority to release 8.72M FET from a bridge and mint about 2.3 billion AGIX, NTX, WMTX and CGV. Sixteen wallets, four labelled as SingularityNET or NuNet staff, were swept before the minting. Headlines cited $16.77M, but Rekt's transaction-level count found about $2.29M in sellable proceeds because most minted tokens could not be sold. Bridges and converters are offline and AGIX is being replaced, so holders should wait for official migration steps.\n\n## Am I affected?\nIf you hold AGIX, NTX, WMTX or CGV, or had tokens moving through SingularityNET's bridges or converters, your tokens may be affected by the pause and the AGIX replacement.\n\n## What to do now\n- Don't buy or swap the affected tokens on DEXs until the projects publish official migration details; prices of freshly minted supply can collapse.\n- Only follow migration steps posted on SingularityNET's official channels. Treat 'claim your replacement token' links in replies and DMs as phishing.\n\n## How to avoid this\n- For teams: keep bridge signing keys in hardware security modules, require several independent signers, and apply the same limits to inbound and outbound conversions.\n- For users: prefer bridges with multi-party verification and rate limits, and don't leave tokens sitting in bridge contracts.\n\n## Indicators (block these, never visit them)\n- Address: 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe\n- Address: 0x83f4424a401a9bb75f90314f21adaea6a9ce09c5\n\n## Sources\n- SingularityNET - Rekt (Rekt News, 2026-09-25): https://rekt.news/singularitynet-rekt\n\nFull record: https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026 · JSON: https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}