【5,700 NFTs Drained Overnight, Attacker Cashed Out Just $3,100】
The most ironic part of the attack on Talis Protocol is that the attacker stole around 5,700 NFTs but ultimately received only about 445 $INJ , worth roughly $3,100, by dumping them through public buy offers. The NFTs were sold off at low prices, leaving the original owners and buyers who had placed legitimate bids to bear the losses.
The vulnerability was in Talis’s marketplace and auction contracts deployed on Injective. The attacker bypassed the contracts’ security mechanisms, withdrew escrowed assets, and used existing buy orders to cash out. The platform subsequently paused multichain listings and auctions, returned more than 26,000 NFTs held in its contracts, and began preparing to recover the stolen assets and compensate buyers whose offers were filled.
INJ is currently trading at around $7.20, down roughly 9% over the past week. So far, there is little sign that the attack has caused a clear, independent price impact. After all, the target was Talis’s application contracts, not Injective’s underlying network.
But the incident has dealt a significant blow to the NFT market. Users entrusted their NFTs to the platform for easier trading, only for the platform’s contracts to become the point of entry for asset theft. With crypto security incidents occurring one after another lately, what the market needs most is no longer a new narrative, but security that gives users the confidence to entrust their money and assets to platforms.
The most ironic part of the attack on Talis Protocol is that the attacker stole around 5,700 NFTs but ultimately received only about 445 $INJ , worth roughly $3,100, by dumping them through public buy offers. The NFTs were sold off at low prices, leaving the original owners and buyers who had placed legitimate bids to bear the losses.
The vulnerability was in Talis’s marketplace and auction contracts deployed on Injective. The attacker bypassed the contracts’ security mechanisms, withdrew escrowed assets, and used existing buy orders to cash out. The platform subsequently paused multichain listings and auctions, returned more than 26,000 NFTs held in its contracts, and began preparing to recover the stolen assets and compensate buyers whose offers were filled.
INJ is currently trading at around $7.20, down roughly 9% over the past week. So far, there is little sign that the attack has caused a clear, independent price impact. After all, the target was Talis’s application contracts, not Injective’s underlying network.
But the incident has dealt a significant blow to the NFT market. Users entrusted their NFTs to the platform for easier trading, only for the platform’s contracts to become the point of entry for asset theft. With crypto security incidents occurring one after another lately, what the market needs most is no longer a new narrative, but security that gives users the confidence to entrust their money and assets to platforms.