FORENSIAWeb3 forensicsOpen workspace
Case file 02

SingularityNET: Bridge Drain and Token Mints

One signature check, then about 2.3 billion tokens minted across four projects. The headline said $16.77M. Followed sale by sale, the liquid proceeds come to roughly $2.29M.

Date
September 19–20, 2026
Network
Ethereum
Reported amount
8.72M FETdrained from the SingularityNET bridge
What happened
Bridge signing key, then unbacked mints
Status
No one named
This file rests on
8 recorded and 12 reported statementsacross 6 linked identifiers
8 chapters · choose one to jump the film to it
The investigation, step by step

Replay it yourself.

These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.

  1. The incident

    An attacker drains FET from SingularityNET's bridge, then spends a night minting tokens across four projects.

    Reported by others
    • About 2.3 billion tokens were minted across four projects.rekt.news

  2. The drain

    At 20:21 UTC a single call to the bridge releases 8.72 million FET to one address. The trace shows one signature check and nothing else.

    Recorded · captured October 6, 2026
    • One call to the bridge, and one signature check inside it.
    • The receipt logs 8,721,530.40 FET to 0x2dcc…1dfE.
    Reported by others
    • The drain happened at 20:21:47 UTC.Blockscout (public explorer)
    • The bridge's authorizer key had been compromised.SlowMist
    • Cloud infrastructure had been accessed.SingularityNET
    Open this step in the workspace
    Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.

  3. The sale

    Two minutes and twenty-four seconds later the FET is sold.

    Recorded · captured October 6, 2026
    • The transaction holds 2 token events and 19 nested calls.
    • Events alone do not establish a swap or an actual balance change.
    Reported by others
    • The sale happened at 20:24:11 UTC.Blockscout (public explorer)
    • It raised about 522 ETH.rekt.news
    Open this step in the workspace
    Opens a live lookup on the Activity view. Today’s capture may differ from the film’s.

  4. The first mint

    At 20:50 UTC, 408 million NTX arrive from the zero address. That is a mint: new tokens created, not existing ones transferred.

    Recorded · captured October 6, 2026
    • The receipt logs 408,532,878.13 NTX from the zero address to 0x2dcc…1dfE.
    • The function selector is 0x40c10f19, which is mint.
    Reported by others
    • The mint happened at 20:50:11 UTC.Blockscout (public explorer)
    Open this step in the workspace
    Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.

  5. A night of minting

    Between 03:13 and 04:38 UTC more mints follow across three other tokens.

    Reported by others
    • AGIX was minted in 90 calls, WMTX in 503 and CGV in 50.rekt.news
    Open this step in the workspace
    Opens a live lookup on the Activity view. Today’s capture may differ from the film’s.

  6. The headline number

    Early reports valued the holdings at $16.77 million. That figure did not survive the market: one sale moved 246 million CGV for about a hundredth of an ETH.

    Reported by others
    • The holdings were valued at $16.77M.PeckShield
    • One sale exchanged 246,198,550.58 CGV for 0.012319587 ETH.Blockscout (public explorer)
    • Liquid proceeds came to about $2.29M.rekt.news
    Open this step in the workspace
    Opens a live lookup on the Activity view. Today’s capture may differ from the film’s.

  7. What it did to supply

    Minting on this scale changes how much of each token exists.

    Reported by others
    • 70.1% of measured AGIX supply was minted in the attack.Bitquery

  8. Where it stands

    The main address still holds ETH. How the key was obtained and who holds the address are not known.

    Recorded · captured October 6, 2026
    • The main address held 433.045752 ETH on the capture date.
    • Its sequence counter stood at 195.
    Open this step in the workspace
    Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.
The number and the record

What the headline said. What a closer reading shows.

The headline said$16.77M

early valuation of the attacker's holdings

PeckShield
On a closer reading≈$2.29M

liquid proceeds, followed sale by sale

rekt.news reconstruction
The incident on one map

Who called what, and where it went.

Recorded in the workspaceReported by others

1 call · 1 signature check8.72M FET408.5M NTX mintedAGIX, WMTX, CGV mintedFET sold · ≈522 ETH246M CGV · 0.0123 ETH0x1572F2…86c362Called the bridgeThe bridge0xab42…f3a3The zero addressWhere minted tokens come fromThe main address0x2dcc…1dfEThe second address0x83f4…09c5Sold on the marketSwaps for ETH
Timeline

In the order it happened.

  1. 8.72M FET leaves the bridge in one call.Recorded

  2. The FET is sold, 2 minutes 24 seconds later.Reported by others

  3. 408.5M NTX is minted to the main address.Recorded

  4. AGIX, WMTX and CGV are minted in hundreds of calls.Reported by others

  5. The main address holds 433.05 ETH.Recorded

The cast

Every address and transaction in this case.

Grouped by their place in the records. A group says what an address did here, not who controls it. Supported identifiers open as live lookups.

Open the investigation

What was taken from

The wallet, bridge or addresses the value left.

  • The bridgeEthereum contract

    The contract the drain was called on.

    Investigate

Where it went

Addresses that received the value. Who controls them is not established here.

  • The main addressEthereum address

    Received the drained FET and the minted tokens. The film's flow diagram is built around it.

    Investigate
  • The second addressEthereum address

    Received the later mints and made the CGV sale shown in the film.

    Investigate

The transactions

The individual records each step of the case rests on.

  • The drainEthereum transaction

    8.72M FET leaves the bridge after one signature check.

    Investigate
  • The saleEthereum transaction

    Two minutes and twenty-four seconds later, all of the FET is sold.

    Investigate
  • The first mintEthereum transaction

    408.5M NTX minted from the zero address to the main address.

    Investigate
Recorded and reported

Two kinds of statement, kept apart.

Recorded statements were read in the workspace on October 6, 2026. Reported statements come from the source named beside each one and were not verified by Forensia. How the key was obtained and who holds the address are not known. No one has been named.

What the chain records8

  • Step 2

    One call to the bridge, and one signature check inside it.

  • Step 2

    The receipt logs 8,721,530.40 FET to 0x2dcc…1dfE.

  • Step 3

    The transaction holds 2 token events and 19 nested calls.

  • Step 3

    Events alone do not establish a swap or an actual balance change.

  • Step 4

    The receipt logs 408,532,878.13 NTX from the zero address to 0x2dcc…1dfE.

  • Step 4

    The function selector is 0x40c10f19, which is mint.

  • Step 8

    The main address held 433.045752 ETH on the capture date.

  • Step 8

    Its sequence counter stood at 195.

What others have reported12

  • Step 1

    About 2.3 billion tokens were minted across four projects.rekt.news

  • Step 2

    The drain happened at 20:21:47 UTC.Blockscout (public explorer)

  • Step 2

    The bridge's authorizer key had been compromised.SlowMist

  • Step 2

    Cloud infrastructure had been accessed.SingularityNET

  • Step 3

    The sale happened at 20:24:11 UTC.Blockscout (public explorer)

  • Step 3

    It raised about 522 ETH.rekt.news

  • Step 4

    The mint happened at 20:50:11 UTC.Blockscout (public explorer)

  • Step 5

    AGIX was minted in 90 calls, WMTX in 503 and CGV in 50.rekt.news

  • Step 6

    The holdings were valued at $16.77M.PeckShield

  • Step 6

    One sale exchanged 246,198,550.58 CGV for 0.012319587 ETH.Blockscout (public explorer)

  • Step 6

    Liquid proceeds came to about $2.29M.rekt.news

  • Step 7

    70.1% of measured AGIX supply was minted in the attack.Bitquery

Keep going

The ideas behind this case, and what to read next.

Docs · 4 minTokens, events and approvals

Why a token transfer is a log entry, what an approval allows, and how fake tokens exploit familiar names.

Docs · 5 minBridges, mixers and exchanges

Three places a trail commonly stops, what each one does, and what can still be said afterwards.

Docs · 5 minFollowing funds, one hop at a time

A method for tracing that stays honest about what each step establishes.

Case · Ethereum · SigningBybit: Multisig Wallet Takeover

$1.5B, from one Bybit wallet.

Case · Ethereum · ExchangeBitget: Exchange Wallet Drain

$387.5M, left Bitget in under three hours.

Share and cite

Take the case with you.

The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.

FORENSIA

Web3 forensics that shows its sources. Read-only, public evidence, and a clear line where the proof ends.

Contact us

Leave your name and email and the Forensia team will write back.

How we handle your emailOr email us directly

By selecting Contact me you agree that Forensia may email you at this address about your enquiry. You can withdraw anytime. Name, email and consent are kept for up to 90 days, separately from investigations. No searched address is included in this submission.