An attacker drained about 5,700 escrowed NFTs from Talis Protocol, an NFT marketplace on Injective, and walked away with roughly $3,100. That is a large number of tokens for a very small payout. The Talis Protocol exploit has still frozen trading on the platform and left the team with a cleanup that will be harder than the theft itself.
Talis said late on Saturday, Oct. 31, that the attacker exploited a bug in its marketplace and auction contracts on Injective. The NFTs taken were ones users had placed in escrow to list or auction, and they were “sold into open collection offers,” according to the team.
What the on-chain data shows
The Block reported on Sunday that on-chain data it reviewed shows the attacker netted about 445 INJ, or roughly $3,100. Most of the NFTs went to bid bots, with a median sale price of about 2 cents. The proceeds were swapped to USDT and bridged to Ethereum within about an hour of the exploit, according to the same report.
The figures say something about how the money was made. Spread evenly across 5,700 tokens, $3,100 works out to roughly 54 cents per NFT. With a median of 2 cents, the bulk of the attacker’s take must have come from a smaller set of higher standing bids, while thousands of tokens were dumped for almost nothing.
Collection offers are the reason the attacker could exit so quickly. A collection offer is a standing bid on any item from a given collection, so a seller holding a token from that collection can fill it at once without waiting for a buyer. For an attacker holding thousands of NFTs that the market would soon flag as stolen, those bids worked as instant liquidity, even at prices close to zero.
How Talis responded
In its six-part thread, Talis set out the steps it has taken so far:
- New listings and auctions on Injective are halted, and more than 26,000 NFTs held in the contracts have been returned to their owners. Users whose listings or auctions disappeared were told to check their wallets.
- New listings and auctions are also paused on its other chains as a precaution. The Talis site lists hubs on Injective, Xion and Orai.
- Patched contracts are ready and under review before deployment. No timeline has been given.
- The team says it has recorded every affected NFT, its owner before the theft and every filled offer, and is working on a plan to restore the NFTs to their original owners and “make offer makers whole.”
Talis asked users not to buy, list or bid on the platform until it confirms things are safe, though open offers can still be cancelled. It also said it will publish a list of the affected NFTs and asked people not to buy them in the meantime. A full post-mortem is promised.
The hard part is getting the NFTs back
Returning 26,000 escrowed NFTs was the easy half of the job, because those tokens were still sitting in Talis contracts. The 5,700 that were stolen have already changed hands. Many now sit in wallets run by bid bots that filled standing offers, and Talis has not said how it plans to recover them or who will fund any compensation.
The wording of the plan points to a two-sided fix: original owners get their NFTs back, and the buyers whose offers were filled are compensated so they do not lose the money they paid. How that works in practice, and whether bot operators will cooperate, is the open question. Talis has not disclosed the root cause of the bug, the collections affected or whether the patched code has been reviewed by an outside auditor.
For the wider market, the incident is small in dollar terms, especially in a month when October’s hack losses reached about $6.5 billion. It does, however, show how thin NFT pricing has become in smaller ecosystems, a trend that also showed up when NFT Price Floor shut down. When the deepest bids for thousands of tokens sit at a few cents, an exploit can do real damage to holders while barely paying the attacker.
What to watch
The next markers are the published list of affected NFTs, the post-mortem explaining the bug, and a deployment date for the patched contracts. Users on the Xion and Orai hubs should also watch for confirmation of when trading resumes there, since those chains were paused as a precaution rather than because of reported losses. Talis has warned that it will never DM users or ask them to connect a wallet to claim anything, which makes any “claim” link circulating in the meantime a likely phishing attempt.
FAQ
What happened to Talis Protocol?
An attacker exploited a bug in Talis’s marketplace and auction contracts on Injective on Oct. 31, took about 5,700 escrowed NFTs and sold them into open collection offers.
How much did the attacker make?
About 445 INJ, or roughly $3,100, according to on-chain data reviewed by The Block. Most NFTs sold for pennies, with a median price of about 2 cents.
Can Talis users trade right now?
No. New listings and auctions are paused on Injective and on Talis’s other chains until patched contracts are deployed. Users can still cancel open offers.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
