TON Network's TAC Reports Security Incident with Asset Recovery

A security incident occurred on May 11 involving the TON-TAC asset bridge, according to ChainCatcher. TAC has released a detailed post-incident analysis report, revealing that the vulnerability stemmed from a missing verification in the sequencer software. An attacker deployed a fake Jetton wallet on TON, which was accepted by the sequencer due to the lack of verification of the sender wallet's code hash. The total loss amounted to approximately $2.86 million, affecting USDT, BLUM, and tsTON tokens. Following a public appeal, about 90% of the assets were returned to a TAC-controlled multi-signature address by May 14, with the attacker retaining the remaining 10%. The cross-chain bridge remains paused, pending an independent review of the patched sequencer software by auditors and TON partners. Operations will resume once the software is verified and the asset shortfall is covered using recovered assets and TAC Foundation's token reserves. Due to the need for coordination among multiple parties, no specific timeline is available. The TAC Foundation treasury will cover the remaining shortfall, ensuring no financial loss for users and protocols. TAC advises users that official updates will only be communicated through their account and Telegram, warning against unsolicited messages claiming to offer 'recovery' or 'support.'