Talis Protocol suffers NFT exploit on Injective blockchain

An attacker exploited vulnerabilities in the marketplace and auction smart contracts of Talis Protocol, an NFT marketplace built on the Injective blockchain. The exploit resulted in the unauthorized withdrawal of approximately 5,700 escrowed NFTs.

To liquidate the assets, the attacker sold the stolen NFTs into open collection offers, often at significantly reduced prices. While the volume of assets was high, the total profit for the attacker was estimated at approximately 445 INJ, valued at roughly $3,100 at the time of the incident.

Talis Protocol responded by pausing all new listings, auctions, and operations across supported blockchain networks to contain the damage. The platform has announced plans to return the stolen NFTs to their original owners and is in the process of returning over 26,000 NFTs to users as part of a broader cleanup of escrowed assets.