Layer 1 Blockchain Project TAC Loses Approximately $7.5 Million Due to Cosmos EVM Vulnerability
Layer 1 blockchain project TAC has confirmed that hackers exploited a vulnerability in the Cosmos EVM module's precompiled layer to steal approximately $7.5 million from an account, transferring about 2.986 billion TAC tokens from a custodial account.
The project team stated that no new tokens were created, and the attack only involved TAC tokens, with other assets unaffected. TAC has paused its network at block 24,671,475, freezing all transactions and deposits/withdrawals, and is working with exchanges and SEAL 911 to trace the stolen funds.
The vulnerability is not in TAC's proprietary code but in the shared Cosmos EVM module, with multiple chains using this module suffering similar attacks within a day. The project plans to release a technical post-mortem report and a restart plan to normalize TAC balances and implement necessary fixes.
Previously, MANTRA Chain also suffered a similar attack due to the Cosmos EVM module and resumed operations after pausing for about 30 hours. On the same day, Cosmos officials advised affected chains to suspend operations.
As a result of this incident, Cosmos ecosystem chains using the shared EVM module face systemic risks, with funds flowing from affected custodial accounts to the attackers' addresses. Beneficiaries include security auditing and tracking services, while those under pressure are L1 projects and token holders relying on this module.
Source: Public Information
ABAB AI Insight
TAC, as a Layer 1 connecting EVM with the TON/Telegram ecosystem, has previously experienced security incidents related to bridging. This attack targets the shared Cosmos EVM precompiled layer, originating from the same source as incidents involving MANTRA Chain and others, exposing common vulnerabilities in upstream modules.
In terms of capital flow, the attacker directly transferred tokens from existing custodial accounts rather than minting new ones, moving resources from the project's treasury to external addresses. The motivation was to quickly extract value using the precompiled interface vulnerability of the cross-chain compatibility layer, avoiding complex minting traces. The project is recovering funds through a network-wide pause and collaboration with exchanges.
This is similar to the early 2026 SagaEVM and multiple attacks on shared components within the Cosmos ecosystem; currently, we are in a phase where EVM-compatible modules are being centrally utilized, highlighting the dependency risk across multiple chains.
This fundamentally exposes the risk of technological substitution. Shared modules accelerate development but also concentrate vulnerabilities, with the mechanism being that the precompiled layer, serving as a bridge between virtual machines, becomes a single point of failure, forcing projects to shift from "rapid compatibility" to mandatory pauses and upstream fixes, reshaping the security dependency structure of the Cosmos EVM ecosystem.
ABAB News · Cognitive Law
Shared modules, shared risks
Pausing is a stop-loss, fixing is rebirth
The deeper the compatibility, the faster the spread of vulnerabilities