S7iter

🚨 The Fetch.ai exploit has a fourth victim nobody has named: World Mobile. 500,529,231 WMTX minted through its own converter, 03:38-04:36 UTC. Different company, different multisig, no shared signers. Same compromised signing pattern. etherscan.io/address/0x63bbc… This is the part that stops being a Fetch.ai story. World Mobile's converter is 0x63bbc71c, a TokenConversionManagerV2 — the same contract family as the Fetch.ai V3 and the SingularityNET v1. Its owner is a 3-of-4 Safe at 0x9369334c. I pulled the signer list on both multisigs and compared them: zero overlap. Two unrelated organizations. What they share is the shape of the key that broke. Three signing keys, all with nothing behind them FET authorizer 0x69e5446b — nonce 0 AGIX authorizer 0x69697dac — nonce 0 WMTX authorizer 0x09578799 — nonce 0 None of the three has ever sent a transaction. A signer address that has never transacted is not sitting in someone's hardware wallet — it exists to be called by a server. Three separate projects, three keys that live in backends, all three producing valid signatures for the same attacker on the same night. That is the dependency worth naming. Not the contract. How the WMTX leg ran 504 mints, 03:38:23 to 04:36:11. 500 of them exactly 1,000,000. The recipient nets 997,000 per call, not 1,000,000 — the missing 3,000 leaves in two 1,500 fee transfers to 0xe7b81ea2 and 0x48b21074. So the per-call figure is the cap, less a 0.3% fee. Same signature as the AGIX leg: a long run of identical maximum-size calls is what a binding limit looks like from outside. WMTX totalSupply went 1,027,930,149.42 to 1,494,037,869.44. Up 466,107,720, a 45.3% increase, net of the conversions burning in the other direction. Converter balance now: zero. V2 kept the brake that V3 dropped conversionIn on this contract carries checkLimits(amount), nonReentrant and notZeroAddress. The Fetch.ai V3 version of the same function carries only notZeroAddress. That is why the WMTX leg needed 504 transactions and the FET leg needed one. The regression is specific to V3. Anyone auditing this family should diff conversionIn across versions before anything else. The number that is still open V2 enforces a maxSupply, set to 2,000,000,000 WMTX. Supply is at 1,494,037,869. 505,962,130 WMTX are still mintable, and the authorizer that signed all 504 calls has not been rotated. The minting stopped at 04:36. Nothing on-chain made it stop. Do not print the notional The two collector wallets hold 398,577,793 WMTX between them. At screen price that reads $6.45M. Total WMTX liquidity across every pool on every chain is $470,366, and most of it is the WBNB pair on BSC, not Ethereum. The realizable number is bounded by that, not by the balance. This is the third time tonight the same trap has been set. The NTX mint was reported at $462,730 against $27,400 of liquidity and returned $42,367. Read the pools, not the balance. There is a fifth Collector #2 also received 492,397,101 CGV, Cogito Governance Token, minted straight to it. Total CGV liquidity: $37. Nothing to realize, which is presumably why half of it was moved on rather than sold. Where the money actually is collector #1 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe — 632.92 ETH collector #2 0x83f4424a401a9bb75f90314f21adaea6a9ce09c5 — 83.88 ETH 716.80 ETH between them, unmoved. The FET leg alone accounts for 522.78 of it. Four token mints across three converters produced less than the single swap that started the night. Addresses WMTX token — 0xdbb5cf12408a3ac17d668037ce289f9ea75439d7 WMTX converter — 0x63bbc71c034bc99a905d5594df985c218a35d392, V2, emptied WMTX authorizer — 0x09578799fd680ffbafd3c84276d598cd3b0ac9c1, nonce 0, unrotated WMTX owner Safe — 0x9369334cc21f445731201eca008419751e4e9e5d, 3-of-4 CGV token — 0xaef420fd77477d9dc8b46d704d44dd09d6c27866 Verified at block 26,016,886, 06:19:47 UTC.