SingularityNET Bridge Hack Widens: 260M AGIX and 53.8M WMTx Minted Without Authorization

A bridge exploit that began on September 19, 2026, has widened into a broader key-compromise event across the SingularityNET bridge stack. What started as a drain of Fetch.ai's Ethereum-based token converter and the unauthorized minting of 408.5 million NuNet Token (NTX) escalated when the same attack cluster minted 260 million SingularityNET Token (AGIX) and 53.838 million World Mobile Token (WMTx) on Ethereum on September 20.

Timeline of the attack

Blockchain security firm PeckShield reported at 09:21 UTC on September 20 that the exploiter had minted 260 million AGIX and 53.838 million WMTx on Ethereum. At the time of the alert, PeckShield valued the cluster's holdings at about $16.77 million, comprising 198.3 million AGIX worth approximately $14.42 million, 649 ETH worth approximately $1.67 million, and 33.538 million WMTx worth approximately $627,350.

The security firm had previously valued the FET drain at about $1.53 million and the NTX mint at about $462,730. The widening scope underscores how bridge infrastructure can amplify a single compromised key into cross-ecosystem damage.

What the teams have said

Fetch.ai posted at 16:19 UTC on September 20 that Fetch.ai contracts were not under threat and that FET continues to operate normally. The team said the attack targeted SingularityNET contracts, primarily the SingularityNET Bridge between Ethereum and Cardano, and that the unauthorized mints used that route.

AGIX-to-FET conversions have been paused, and the Ethereum-side Fetch.ai bridge was paused as a precaution. Fetch.ai said the exploit had been contained and that it was continuing to work with SingularityNET.

World Mobile Chain confirmed at 05:07 UTC on September 20 that the SingularityNET bridge had been exploited and that WMTx had been minted on Ethereum without authorization, driving price action on listed venues. The team said it was contacting exchanges to freeze affected deposits and working with security partners to revoke minting authorities.

Why bridge hacks keep happening

Cross-chain bridges remain among the highest-risk components in Web3 infrastructure. They hold or attest to assets on multiple chains, which makes them attractive targets. When private keys or minting authorities for bridge contracts are compromised, attackers can create tokens that appear legitimate on destination chains until issuers and exchanges react.

The SingularityNET incident is a case study in cascade risk. A vulnerability or key compromise on one bridge route can affect tokens that users never intended to bridge — including assets whose teams believed they were insulated from the affected infrastructure.

Lessons for builders and users

For developers, the incident reinforces several practices that should be non-negotiable in 2026: multi-signature controls on minting authorities, real-time monitoring with firms like PeckShield, pre-agreed exchange communication channels, and circuit breakers that pause conversions when anomalies appear.

For users, the practical advice is equally blunt. Treat bridged representations of assets as higher-risk than native chain holdings during active incidents. Watch official team channels before trading affected tokens, and assume price dislocations until minting authorities are revoked and exchanges confirm deposit freezes.

The Web3 industry has improved incident response compared to earlier years, but the SingularityNET bridge hack shows the attack surface is still expanding faster than defenses in some corners of the stack.