SlowMist(@SlowMist_Team):🚨SlowMist TI Alert🚨 💸 @Fetch_ai Loss: ~$2M 🔍 Root Cause: TokenConversionManagerV3's conversionIn() leaves single-EOA ECDSA signature as the sole authorization check. It lacks the checkLimits(amount) modifier present in conversionOut(), and does not verify any on-chain burn/lock proof. Using the leaked authorizer private key, the attacker signed a fresh message for their own address, passed the check, and drained the bridge's entire FET balance in one call. 📌 Attacker: 0x1572f2af7696b39c85e3221cde8efb640f86c362 📌 Recipient: 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe 📌 Victim/Vulnerable Contract: 0xab424a430cc09864fa1277a38193111705adf3a3 Powered by https://t.co/Mz5jOnx997 Tx:

2026.09.20 02:47

🚨SlowMist TI Alert🚨 💸 @Fetch_ai Loss: ~$2M 🔍 Root Cause: TokenConversionManagerV3's conversionIn() leaves single-EOA ECDSA signature as the sole authorization check. It lacks the checkLimits(amount) modifier present in conversionOut(), and does not verify any on-chain burn/lock proof. Using the leaked authorizer private key, the attacker signed a fresh message for their own address, passed the check, and drained the bridge's entire FET balance in one call. 📌 Attacker: 0x1572f2af7696b39c85e3221cde8efb640f86c362 📌 Recipient: 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe 📌 Victim/Vulnerable Contract: 0xab424a430cc09864fa1277a38193111705adf3a3 Powered by Tx: