Talis Protocol NFT Contracts on Injective Exploited, About 5,700 NFTs Sold

About 5,700 NFTs held in custody were withdrawn and sold into public collection offers after attackers exploited Talis Protocol’s marketplace and auction contracts on Injective. According to ChainCatcher, the Cosmos ecosystem NFT marketplace disclosed the incident on X on October 31. Talis has paused new listings and auctions on Injective and returned more than 26,000 NFTs held in its contracts to their owners. It has also paused new listings and auctions on other chains as a precaution, and advised users not to buy, list or bid on Talis until the fix is confirmed secure. Users can still cancel unfilled offers; those whose listings or auctions have disappeared can check their wallets. Talis said a patched contract is ready and undergoing review before deployment, with a timeline to be announced later. The team has documented each affected NFT, its owner before the theft and the offer involved in each sale. It is developing a plan to return the NFTs to their original owners and compensate offer-makers, and plans to publish a list of affected NFTs. The marketplace advised users not to buy those NFTs. Talis said it will not ask users via direct message to connect a wallet to claim anything, and that a full postmortem will follow. RootData lists Talis Protocol as founded in 2021 and says it completed a $2.35 million private funding round in November 2021.