一名攻击者，多个代币：Fetch.ai 漏洞内部 - 纽约一分钟

Fetch.ai 泄露事件最初被认为是价值 150 万美元的 FET 代币盗窃案，现已发展成为涉及 NTX、AGIX 和 WMTX 的多代币传奇，攻击者持有的总资产目前已超过 1700 万美元。这一事件凸显了被盗代币和新铸造代币之间的关键区别，揭示了超出最初财务损失的更深层次的安全影响。

Folks, gather 'round, because we've got a real head-scratcher brewing in the digital realm. What started as a seemingly contained incident, a mere blip on the blockchain radar for Fetch.ai, has escalated into a sprawling drama of 'One Attacker, Multiple Tokens.' It’s the kind of story that reminds you that in the wild west of crypto, things are rarely as simple as they first appear.

伙计们，聚集在一起，因为数字领域正在酝酿着一场真正令人头疼的事情。一开始看似受控的事件，只是 Fetch.ai 区块链雷达上的一个小插曲，现已升级为一场“一个攻击者，多个代币”的庞大戏剧。这个故事提醒你，在加密货币的狂野西部，事情很少像最初看起来那么简单。

The Plot Thickens: Beyond the Initial FET Fiasco

情节更加复杂：超越最初的 FET 惨败

Initially, the buzz was all about a cool 8.7 million FET tokens, roughly $1.5 million worth, that vanished from Fetch.ai's TokenConversionManagerV3 contract. A bummer, for sure, but seemingly a straightforward theft. However, as the digital detectives at Fetch.ai and their partners at SingularityNET dug deeper, the plot thickened faster than a New York cheesecake.

最初，人们热议的是 870 万个 FET 代币（价值约 150 万美元）从 Fetch.ai 的 TokenConversionManagerV3 合约中消失了。这确实是一件无赖的事，但看起来却是一起简单的盗窃案。然而，随着 Fetch.ai 的数字侦探和 SingularityNET 的合作伙伴深入挖掘，情节变得比纽约芝士蛋糕还快。

It turns out the attacker wasn't just content with a single haul. The same digital wallet, a veritable digital briefcase for ill-gotten gains, was later linked to a staggering 409 million NTX tokens, conjured out of thin air via a NuNet deployer account. And just when you thought it couldn't get any wilder, PeckShield chimed in, connecting the same wallet to unauthorized mints of 260 million AGIX and 54 million WMTX. Suddenly, that initial $1.5 million loss felt like pocket change, with the attacker's total haul soaring to nearly $17 million. Talk about an ambitious thief!

事实证明，攻击者不仅仅满足于一次运输。同一个数字钱包，一个名副其实的用于非法所得的数字公文包，后来与通过 NuNet 部署者帐户凭空变出的惊人的 4.09 亿个 NTX 代币相关联。就在你以为事情已经不能再疯狂的时候，PeckShield 插话了，将同一个钱包连接到未经授权的 2.6 亿个 AGIX 和 5400 万个 WMTX 铸币厂。突然间，最初的 150 万美元损失感觉就像零钱，而攻击者的总收益飙升至近 1700 万美元。谈论一个野心勃勃的小偷！

The Two Faces of Digital Damage: Stolen vs. Minted

数字损坏的两个方面：被盗与铸造

This whole kerfuffle brings to light a crucial distinction that’s often overlooked: the difference between stolen tokens and newly minted tokens. When FET was swiped, existing tokens changed hands, creating a loss but not inflating the overall supply. It's like someone lifting a few bills from your wallet – painful, but the total amount of money in circulation remains the same.

整个混乱揭示了一个经常被忽视的关键区别：被盗代币和新铸造代币之间的区别。当 FET 被盗时，现有代币易手，造成损失，但不会导致整体供应量增加。这就像有人从你的钱包里取出几张钞票——很痛苦，但流通中的货币总量保持不变。

But with NTX, AGIX, and WMTX, we're talking about a different beast entirely. These tokens were reportedly *minted* without authorization, essentially creating new supply out of nowhere. Imagine a counterfeiter suddenly printing a significant chunk of the world's currency – that's the kind of market-shaking impact we're talking about. The reported NTX mint alone was roughly 41% of its stated maximum supply, a move that sent its price plummeting by 70%. It's a stark reminder that in the crypto game, not all losses are created equal.

但对于 NTX、AGIX 和 WMTX，我们谈论的是完全不同的野兽。据报道，这些代币是在未经授权的情况下“铸造”的，本质上是凭空创造了新的供应。想象一下，一个造假者突然印制了世界上很大一部分货币——这就是我们所说的那种撼动市场的影响。据报道，仅 NTX 铸币厂就达到了其规定最大供应量的 41% 左右，这一举措导致其价格暴跌 70%。这是一个鲜明的提醒，在加密货币游戏中，并非所有损失都是平等的。

The Phantom Key: A Valid Signature, a Rogue Act

幻影钥匙：有效签名，流氓行为

So, how did this digital heist go down? Fetch.ai's preliminary analysis points to a leaked signing key. This isn't your garden-variety hacking where someone brute-forces their way in. Instead, the attacker presented a *valid* conversion-authorizer signature, making their instructions appear legitimate to the smart contract. It's like a thief having a genuine key to your apartment – the lock works perfectly, but the person using it is a crook.

那么，这起数字盗窃案是如何进行的呢？ Fetch.ai 的初步分析指出签名密钥被泄露。这不是普通的黑客攻击，即有人强行进入。相反，攻击者提供了一个*有效的*转换授权者签名，使他们的指令对智能合约来说显得合法。这就像一个小偷拥有一把真正的公寓钥匙——锁工作得很好，但使用它的人是个骗子。

This highlights a critical vulnerability: even with robust smart contract code, a compromised signing key can undermine the entire system. As SlowMist observed, Fetch.ai's conversion function relied on a single externally owned account signature, potentially lacking the multi-layered security some might expect. It's a sobering thought for anyone relying on digital security: the system is only as strong as its weakest link, and sometimes that link isn't the code itself, but the credentials that authorize its use.

这凸显了一个严重的漏洞：即使有强大的智能合约代码，受损的签名密钥也可能破坏整个系统。正如 SlowMist 观察到的那样，Fetch.ai 的转换功能依赖于单个外部拥有的帐户签名，可能缺乏一些人期望的多层安全性。对于任何依赖数字安全的人来说，这是一个发人深省的想法：系统的强度取决于其最薄弱的链接，有时该链接不是代码本身，而是授权其使用的凭据。

What Now? Deactivation and Lingering Questions

现在怎么办？停用和挥之不去的问题

Fetch.ai and SingularityNET have been quick to deactivate affected wallets and contracts, a crucial step to contain the bleeding. But the investigation is far from over. The real question isn't just how much was taken, but how widely these compromised permissions could be used. Until Fetch.ai can definitively show that all affected permissions have been revoked and no more unauthorized tokens can float through the system, the market will remain uneasy.

Fetch.ai 和 SingularityNET 已迅速停用受影响的钱包和合约，这是遏制疫情蔓延的关键一步。但调查还远未结束。真正的问题不仅仅是被盗取了多少权限，而是这些被盗用的权限可以被使用的范围有多大。在 Fetch.ai 能够明确表明所有受影响的权限已被撤销并且不再有未经授权的代币可以通过系统流通之前，市场仍将感到不安。

Because let's be honest, in the unpredictable world of crypto, trust is everything. And when supply figures become questionable and contract permissions are up in the air, that trust can evaporate faster than a free sample on a hot summer day. So, while we sip our coffees and watch the digital drama unfold, remember: this Fetch.ai breach isn't just about a few missing tokens; it's a wake-up call for the entire ecosystem about the intricate dance between code, keys, and market confidence. Stay vigilant, folks, and keep those digital eyes peeled!

因为说实话，在不可预测的加密世界中，信任就是一切。当供应数据变得可疑且合同许可悬而未决时，这种信任可能会比炎热夏日的免费样品消失得更快。因此，当我们一边喝着咖啡，一边观看数字戏剧展开时，请记住：Fetch.ai 的这次泄露不仅仅是一些丢失的代币；而是与一些丢失的代币有关。这给整个生态系统敲响了警钟，提醒我们注意代码、密钥和市场信心之间错综复杂的关系。伙计们，保持警惕，睁大你的数字眼睛！