NFT marketplace Talis Protocol: Exploited Injective contract, about 5,700 escrowed NFTs were sold
On October 31, 2026, the official Talis Protocol NFT marketplace said that an attacker used a vulnerability in its marketplace and auction contracts on the Injective chain to take out about 5,700 escrowed NFTs and sell them through public open collection offers.
The platform has suspended new listings and auctions on Injective, and will return more than 26,000 NFTs held in the contracts to their original holders. As a precaution, new listings and auctions on other chains have also been suspended; users can still cancel unfilled offers. The fixed contracts are undergoing pre-deployment review, and the timetable will be announced later. The team has recorded each affected NFT, the holder before the theft, and each completed offer, and is formulating a plan to return the affected NFTs to their original holders and compensate the offer makers, after which the affected list will be released. The platform emphasized that it will not ask users via direct message to connect their wallets to claim anything, and a full post-incident statement will be released later.
Original sources:
Title: 1/ Earlier today, Oct 31, an attacker exploited a bug in the Talis marketplace and auction contracts on Injective. About 5,700 escrowed NFTs were taken and sold into open collection offers. Here's where things stand 🧵 Publisher: Talis Protocol (@ProtocolTalis) Publication date: 2026-10-31 URL: https://x.com/ProtocolTalis/status/2116664033457680705 Source nature: first-party post Verification status: the full thread was read for this report (items 1–6), verification date 2026-11-01 Supporting content: attack time, bug location (Injective marketplace and auction contracts), about 5,700 escrowed NFTs taken and sold into open collection offers; new listings and auctions on Injective suspended and more than 26,000 NFTs returned; other chains suspended; fixed contracts under review; affected NFTs, original holders and completed offers recorded and a return and compensation plan being formulated; no requests via direct message to connect wallets; a post-incident statement will be released.
Title: THE BLOCK: Talis Protocol, an NFT marketplace on Injective, said an attacker exploited a bug... Publisher: The Block (@TheBlockCo) Publication date: 2026-11-01 URL: https://x.com/TheBlockCo/status/2116907452788777122 Source nature: media report Verification status: read the post and the official thread it cited, verification date 2026-11-01 Supporting content: core facts from the official statement; on-chain data showed the attacker netted about 445 INJ (about $3,100), most NFTs were sold to bid bots at a median price of about 2 cents, and the proceeds were swapped into USDT and bridged to Ethereum in about 1 hour.
ABAB AI Insight
Talis Protocol was founded in 2021, and in its early stage it was positioned as a DAO marketplace connecting physical art and the blockchain, initially built on Terra. In November 2021, it completed about $2.3 million in seed funding, led by ParaFi Capital and Arrington Capital, with participation from Benson Oak Ventures, Blocbits, GCW Capital and others. The platform later shifted its focus to Injective and expanded to multi-chain support such as Xion and Orai, positioning itself as an NFT marketplace in the Cosmos ecosystem, offering no-code collection creation, on-chain royalty enforcement and other features. The team is small, with public information indicating about 4 employees, and the CEO is Eloi Henrard.
The core mechanism of this vulnerability was the escrow contract. When users list items or participate in auctions, NFTs enter the platform contract in escrow. The attacker used flaws in the marketplace and auction contracts to directly take out about 5,700 NFTs and immediately sell them into existing open collection offers. These offers are continuous bids for an entire collection and do not require waiting for a specific buyer, allowing the attacker to cash out quickly. On-chain data cited by The Block and Crypto Briefing showed that the actual net proceeds were only about 445 INJ (about $3,100 at the time), with most tokens sold by bid bots at a median price of about 2 cents, indicating that the target collection had extremely low liquidity and that the gains were severely out of proportion to the number of assets.
By comparison, around 2022, several NFT marketplaces (such as some projects based on OpenSea or custom contracts) also saw assets taken out in batches because of flaws in escrow logic or permission checks. In those cases, attackers could usually cash out at higher prices, or amplify gains through combinations such as flash loans. What is different about Talis this time is that the monetization channel relied heavily on existing low-priced collection offers, resulting in limited financial losses, but broad ownership disruption; the platform chose to return all more than 26,000 escrowed NFTs in the contracts at once, far more than the number stolen, which is a more aggressive cleanup action rather than recovering only the stolen portion.
For Talis users, the direct change is that temporary control of escrowed assets has been disrupted, and some NFTs have already entered bot wallets. The platform has promised to return assets to their original holders and compensate the offer makers, but the details and implementation timeline have not yet been announced, and the affected list and post-incident statement still need to be awaited. Given the team’s small size and limited funding scale (historical financing of about $2.3 million), whether compensation can cover the original holders’ subjective value loss rather than the on-chain sale price will depend on its subsequent execution capability. The key metrics to watch are the proportion of original holders who actually recover their NFTs after the affected list is released, and whether compensation is delivered in the original offer amounts or in the platform’s token.
ABAB News · Cognition Law
A flaw in the escrow contract let the attacker directly take out assets, but low-liquidity collection offers compressed a large number of assets into small-scale monetization.
The platform chose to return all escrowed NFTs rather than recover only the stolen portion, making the cleanup scope larger than the loss scope, but compensation still awaits implementation of the plan.