Talis Protocol, an NFT marketplace built on the Injective blockchain, has frozen new listings and auctions following a smart contract exploit. An attacker withdrew approximately 5,700 escrowed NFTs from the platform and sold them into open collection offers, generating about 445 INJ tokens worth roughly $3,100.
The attacker targeted vulnerabilities in both the marketplace and auction contracts, which held NFTs in escrow. After extracting the assets, the attacker sold most of them at roughly 2 cents each to bid bots—automated programs monitoring low-price offers. The fire-sale prices resulted in minimal proceeds despite the large number of stolen assets.
Response and Recovery Efforts
Talis responded by halting all new listings and auctions across its platform. As a precaution, it also paused operations on other blockchain networks it supports, though the attack centered on Injective.
The company committed to returning stolen NFTs to their owners and returning more than 26,000 escrowed NFTs to their rightful owners. Talis plans to compensate affected bidders and publish a list of compromised NFTs. A patched version of the affected contracts is under pre-deployment review.
What to Watch
Key developments include the postmortem analysis of the vulnerability, review of the patched contract to determine when normal operations resume, and the timeline for returning affected NFTs to original owners. Users have been warned against purchasing the affected NFTs during the resolution process.
