Talis Protocol NFT Marketplace on Injective Exploited, 5,700 NFTs Stolen

ChainCatcher — Cosmos ecosystem NFT marketplace Talis Protocol said on X on October 31 that an attacker exploited a vulnerability in its market and auction contracts on Injective, withdrawing roughly 5,700 NFTs held in custody and selling them into public collection listings. Talis has suspended new listings and auctions on Injective and returned more than 26,000 NFTs from the contract to their holders. Listings and auctions on other chains were also paused as a precaution. Users are advised not to buy, list or bid on Talis until the fix is confirmed secure, though unfulfilled offers can still be canceled. If listings or auctions disappear, users should check their wallets. The project confirmed the patched contract is ready and undergoing review before deployment, with a timeline to be announced shortly. The team has recorded every affected NFT, its holder prior to the theft and each sale price, and is drawing up a plan to return the NFTs to their original owners and compensate bidders. An official list of affected assets will be published, and users should not purchase these NFTs in the interim. Talis stressed that it will never ask users to connect wallets through direct messages to claim anything. A full post-incident report will be released shortly. RootData shows Talis Protocol was founded in 2021 and closed a $2.35 million private funding round that November.