Fetch.ai bridge exploited for $2 million via leaked secret key.
Security & Exploits ·
A vulnerability in Fetch.ai's bridge contract allowed an attacker to drain approximately $2 million in FET tokens using a leaked private key. The exploit targeted the TokenConversionManagerV3 contract's conversionIn() function, which relied on a single ECDSA signature for authorization without additional security checks present in other bridge functions.
The function lacked a checkLimits modifier and did not verify any on-chain proof of asset burn or lock, creating an attack surface. The attacker obtained the authorizer's private key, used it to sign a message authorizing their own address, and executed a single transaction to withdraw the bridge's entire FET balance. The transaction was processed on Ethereum, with the stolen funds transferred to a separate address.
The incident highlights a significant asymmetry in the bridge's design: the conversionOut() function included security measures absent from conversionIn(), suggesting incomplete threat modeling during development. No timeline has been provided for a fix, and the extent to which Fetch.ai has identified or recovered funds remains unknown.