TAC, as a Layer 1 connecting EVM with the TON/Telegram ecosystem, has previously experienced security incidents related to bridging. This attack targets the shared Cosmos EVM precompiled layer, originating from the same source as incidents involving MANTRA Chain and others, exposing common vulnerabilities in upstream modules.

In terms of capital flow, the attacker directly transferred tokens from existing custodial accounts rather than minting new ones, moving resources from the project's treasury to external addresses. The motivation was to quickly extract value using the precompiled interface vulnerability of the cross-chain compatibility layer, avoiding complex minting traces. The project is recovering funds through a network-wide pause and collaboration with exchanges.

This is similar to the early 2026 SagaEVM and multiple attacks on shared components within the Cosmos ecosystem; currently, we are in a phase where EVM-compatible modules are being centrally utilized, highlighting the dependency risk across multiple chains.

This fundamentally exposes the risk of technological substitution. Shared modules accelerate development but also concentrate vulnerabilities, with the mechanism being that the precompiled layer, serving as a bridge between virtual machines, becomes a single point of failure, forcing projects to shift from "rapid compatibility" to mandatory pauses and upstream fixes, reshaping the security dependency structure of the Cosmos EVM ecosystem.

ABAB News · Cognitive Law

Shared modules, shared risks
Pausing is a stop-loss, fixing is rebirth
The deeper the compatibility, the faster the spread of vulnerabilities