הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
Fetch.ai’s TokenConversionManagerV3 conversionIn() relied on an ECDSA signature from a single authorizer as its principal authorization mechanism. After obtaining that authorizer’s private key, the attacker signed a fresh conversion message for an attacker-controlled recipient and called conversionIn(). Unlike conversionOut(), the function lacked the checkLimits(amount) restriction and did not independently require proof that corresponding assets had been burned or locked on the other side of the conversion. The valid signature was therefore sufficient to release the converter’s entire remaining FET inventory in one transaction
SlowMistתיאור המקור באנגלית
An attacker used a leaked conversion-authorizer / bridge backend signing key to call conversionIn() on Fetch.ai’s Ethereum token-conversion contract and drain about 8,721,530 FET (~$1.53 million). The same wallet cluster then minted about 408.5 million unauthorized NTX via a NuNet deployer key and later expanded the attack to related ASI Alliance bridge/converter infrastructure.
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
Fetch.ai’s TokenConversionManagerV3 conversionIn() relied on an ECDSA signature from a single authorizer as its principal authorization mechanism. After obtaining that authorizer’s private key, the attacker signed a fresh conversion message for an attacker-controlled recipient and called conversionIn(). Unlike conversionOut(), the function lacked the checkLimits(amount) restriction and did not independently require proof that corresponding assets had been burned or locked on the other side of the conversion. The valid signature was therefore sufficient to release the converter’s entire remaining FET inventory in one transaction
SlowMistתיאור המקור באנגלית
An attacker used a leaked conversion-authorizer / bridge backend signing key to call conversionIn() on Fetch.ai’s Ethereum token-conversion contract and drain about 8,721,530 FET (~$1.53 million). The same wallet cluster then minted about 408.5 million unauthorized NTX via a NuNet deployer key and later expanded the attack to related ASI Alliance bridge/converter infrastructure.
