POPA Recon@Fetch_ai hacked for ~$2M
@Fetch_ai hacked for ~$2M Root Cause: TokenConversionManagerV3's conversionIn()lacks the checkLimits(amount) modifier present in conversionOut(), and does not verify any on-chain burn/lock proof. Using the leaked authorizer private key, the attacker signed a fresh message for their own address, passed the check, and drained the bridge's entire FET balance in one call. @EthSecurity1
The excerpt is quoted from a public Telegram channel, which owns its text.