Talis Contract Vulnerability Leads to Theft of Approximately 5,700 NFTs

The Cosmos ecosystem NFT marketplace Talis Protocol confirmed on October 31 that attackers exploited vulnerabilities in its market and auction contracts on Injective, resulting in approximately 5,700 NFTs being withdrawn from custody and sold into public collection bids. Talis has suspended new listings and auctions on Injective and will return over 26,000 NFTs from the contracts to their holders. To prevent similar incidents, new listings and auctions on other chains have also been paused, and users are advised not to buy, list, or bid on Talis until the fixes are confirmed safe. Users can still cancel unexecuted bids. If listings or auctions disappear, users can check their wallets. The project team stated that the fixed contracts are ready and are under review before deployment, with a timeline to be announced later. The team has recorded each affected NFT, the original holders before the theft, and each transaction bid, and is formulating a plan to return the NFTs to their original holders and compensate the bidders. Affected lists will be published, and users are advised not to purchase these NFTs during this period. Talis also emphasized that it will not request wallet connections through private messages to claim any content, and a complete post-incident report will be released later.