The TAC network has remained halted at block 24,671,475 for more than 10 days following an exploit of its bonded staking pool on August 22. The EVM-compatible Layer 1 network connected to the TON ecosystem has not resumed normal block production.
Extent of the Exploit
According to TAC's September 1 postmortem, the attack drained 2,985,651,403.40 TAC, representing 28.6% of total token supply. A single transaction reduced the bonded pool to zero without changing the total token supply, leaving the chain's delegation records without the tokens backing them.
Technical Vulnerability
The Cosmos EVM advisory identified the attack vector as a mismatch between two balance records. The EVM StateDB tracked only an account's spendable tokens, while the Cosmos SDK ledger also tracked locked vesting tokens eligible for delegation. Delegating more than the spendable amount triggered an unchecked subtraction that wrapped toward a number close to 2^256. A second overflow operation then allowed the attacker to zero a victim account while retaining its legitimate tokens. TAC's protocol-controlled staking pool was identified as the victim account.
The advisory classified the flaw as critical and noted that Cosmos EVM versions below 0.6.2, plus versions 0.7.0 and 0.7.1, were vulnerable. Cosmos Labs patched the bug on its main branch May 15 and backported it into releases on August 19, following disclosure through its bounty program on April 25.
Attacker Proceeds and Recovery Plan
TAC reported that the attacker sold 1,208,329,197 TAC on BNB Chain for 950,293 USDT and another 49.9 million TAC on TON for 55,481 USDT, totaling approximately 1,005,774 USDT in proceeds.
The proposed recovery involves a targeted state edit at the halt block that would remove 65,100,989 incident-linked TAC frozen on the TAC network. The edit would restore bonded pool and delegator balances while preserving 7,772 legitimate transactions from 218 unrelated addresses. The TAC Foundation plans to replace 1,258,228,061.40 TAC from treasury reserves to cover tokens sold from the pool.
Outstanding Issues
Network recovery requires validators to adopt the patched binary and resume block production. Bridging and redemption services remain disabled. Critically, 1,662,322,353 TAC held in incident-associated BNB Chain addresses awaits separate resolution, and the treatment of this attacker-held balance has not been settled.
