Recently, the market and auction contracts at the core of the NFT marketplace Talis Protocol deployed on the Injective chain were maliciously exploited. The attacker withdrew about 5,700 NFTs, which were originally in an escrow state, in a single transaction from the custodial contract and sold the assets through public collection offers. This figure has currently only been disclosed from a single source. Realizing the severity of the problem, Talis quickly hit the brakes, pausing all new listings and auction functions on Injective in an attempt to stop further abnormal transactions from spreading, and announced that over 26,000 NFTs held in the affected contracts would be returned to their original owners. They also began to formulate a user compensation plan, although the form and timeline of compensation have not yet been made public. Beyond the technical offensive and defensive aspects, the larger context is that regulators are continuously strengthening the “safety” narrative—U.S. Senator Cynthia Lummis's CLARITY Act emphasizes intelligence sharing between crypto enterprises and federal law enforcement agencies, and the incident where Talis's custodial contract was drained ties the structural risks of custodial NFT contracts directly to the increasingly tightening narrative of regulatory safety.

5,700 NFTs Drained: Vulnerability Explodes Overnight

The incident erupted in what seemed like a “routine” custodial scenario. Talis’s market and auction contracts on Injective were originally designed to facilitate and hold custody: users send NFTs into custodial (escrowed) contracts, which the contracts hold for safekeeping, allowing transactions to be completed through listings or auctions. However, in the recent attack, hackers exploited this layer of “intermediation.” They took advantage of security vulnerabilities in the market and auction contracts to overstep their authority, withdrawing about 5,700 NFTs that were held by the contracts in bulk. On-chain, it appeared more like an operation where the contract itself "opened the door" for release, rather than a direct intrusion into a user's wallet in the traditional sense.

Ironically, after the NFTs were transferred out of the custodial contract, they did not “sink” on-chain, but instead completed the final step through the established market transaction mechanisms. The attackers utilized public collection offers—an open purchase offer that had been listed on the market—to sell the stolen NFTs directly to bidders, achieving quick cash-out. Here, the synergy of contract vulnerabilities and the public offering mechanism is evident: the former opened the door to the custodial warehouse, while the latter provided a ready liquidity outlet for the stolen goods. Based on currently available information, the identity of the attacker has not been disclosed, nor has the specific type of vulnerability been clarified. However, it can be preliminarily judged that under a custodial structure, once the core contract is exploited, users have almost no manual space to recover their assets. This mode of "outsourcing security to contracts" can concentrate all risks within lines of invisible code when audits and stress tests are insufficient.

Custodial Pool Becomes a Minefield: 26,000 NFTs Affected

In a custodial NFT market, listing itself signifies a "turnkey" solution: to facilitate listings and participate in auctions, users no longer let NFTs remain long-term in their own self-custody addresses, but rather transfer them in advance to the custodial contracts provided by the market, allowing the contracts to operate during transactions, settlements, and cancellations. For active traders, this saves the hassle of frequent signing and repeated authorizations, but the cost is that NFTs, originally dispersed across thousands of wallets, are concentrated in a few “public vaults.” The security of a single contract becomes the lifeline for the entire market.

Talis disclosed that the affected contracts held over 26,000 NFTs, which will be returned to their original owners. Currently, about 5,700 NFTs confirmed to have been taken by the attacker were removed. This comparison at least indicates that not all custodial assets were successfully transferred away but also exposes that the scale of the custodial pool far exceeds the portion that ultimately fell into hackers' hands. As one of the NFT trading gateways on Injective, Talis’s custodial contracts were originally designed to aggregate liquidity but now, at the moment of contract failure, amplified the highly dispersed individual risks within the entire ecosystem into a single technical point. Once similar incidents are viewed as a "systemic weakness," NFT participants on Injective will find it challenging to easily press the confirmation button when assessing the convenience of listings against the risks of custody.

Stopping the Bleeding: How Talis Comforts Victims

After the custodial contract was breached and about 5,700 NFTs had been withdrawn, Talis’s first move was to “stop the bleeding”—pausing new listings and auction functions on the Injective chain, temporarily pulling market and auction contracts from the frontend. This step cannot recover the already leaked assets, but at least it stops more NFTs from entering custodial status, avoiding the replication and amplification of the attack logic, and giving the project team a “quiet window” to sort through assets and responsibilities.

Next, Talis focused on “rescuing what can still be saved.” According to their announcement, the over 26,000 custodial NFTs still held in the affected contracts will be returned to their original owners, restoring the ownership order of the custodial assets. For holders of NFTs that have already been stolen, this means that even if the 5,700 NFTs cannot be retrieved, at least the other collections that should have been securely held in the contract will not continue to be trapped in a system proven to have vulnerabilities; for those with custodial assets that were not stolen, the return signifies an early termination of the custodial relationship, allowing them to decide anew whether to trust the same contract set. Meanwhile, Talis stated that it is formulating and implementing a user compensation plan, but has not disclosed the form, proportion, or timeline of compensation. In the absence of an official review from Injective or a third-party security agency, it is difficult for outsiders to assess how future compensation will delineate between "project responsibility" and "user risk." For now, Talis’s current hemorrhage control actions should be viewed as a starting point for restoring community trust rather than the end.

Rampant Hackers and Regulatory Pursuit: CLARITY Act Debuts

After an incident like Talis’s contract breach, the focus naturally shifts to a broader regulatory picture. U.S. Senator Cynthia Lummis recently emphasized that when participants in the crypto industry actively cooperate with law enforcement, the transfer of stolen assets on-chain and off-chain can, to some extent, be intercepted or delayed. Unlike the Talis incident, this statement is more directed towards the inadequacies of regulatory “toolboxes”: currently, even if an attack similar to Talis occurs, where 5,700 NFTs are withdrawn and then sold through public collection offers, the project team's responses are often still limited to pausing contract functions, internal investigations, and post-factum compensation, with on-chain tracking and freezing heavily reliant on whether law enforcement "timely enters the picture."

The CLARITY Act, pushed by Lummis, seeks to establish a more direct information channel for intelligence sharing between crypto enterprises and U.S. federal law enforcement agencies through pilot programs. When articulating the urgency of this pilot, she referenced a case allegedly involving Binance, which has not yet been independently verified, with the amount involved reported to be about $6.3 billion, to emphasize that without institutionalized cooperation, massive crypto assets can be transferred and laundered in a short time. It is crucial to highlight that there is no public evidence indicating a direct connection between this case and the current Talis incident on Injective; it is merely used as a reference for security risks. If legislation similar to the CLARITY Act ultimately comes to fruition, it means that in events lacking public on-chain tracking results, relying solely on project teams for self-rescue, platforms like Talis may be able to interface with law enforcement intelligence faster in the future, shortening the time window for identifying and tracking stolen assets. However, whether this vision can be realized still depends on the design of the bill's terms and the legislative process.

Next Time We Use NFT Custody, We Should Think One Step Further

Returning to this Talis incident, what has truly been exposed is the underlying premise of the custodial NFT market: as long as the market and auction contracts are breached, the approximately 5,700 NFTs under custody can be concentrated and moved out just like this time, and most ordinary users cannot sense the risks in advance, nor do they have immediate means to stop losses and recover NFTs. For project teams, this incident has highlighted three pieces of "infrastructure": first is contract security; audits and grey verification must be completed before formal custody rather than conducting large-scale escrow while iterating in a production environment; second is the control of custodial concentration, avoiding a single contract hoarding over 26,000 NFTs as such a volume creates systemic risk once issues arise; third is the emergency response plan, which should have a preset script for discovering anomalies, pausing listings and auctions, and making announcement statements, rather than responding in haste. For users, each time they choose a custodial NFT market, they can at least ask a few more questions: does the platform have clear safety announcements and change records? Are their NFTs all concentrated in the same custodial contract, and can they be appropriately diversified? What permissions does the custodial contract have, and under what conditions can assets be moved? The answers to these questions determine how passive users are in similar events. Looking ahead, this incident is not yet concluded: Talis promises to return over 26,000 NFTs held in affected contracts and launch a compensation plan, but the pace of execution and degree of realization will directly influence the restoration of confidence in the NFT ecosystem on Injective. On a more macro level, whether regulatory measures like the CLARITY Act can be advanced will also long-term decide if similar platforms can access more mature cross-entity risk control and recovery frameworks beyond technical safety.

Join our community, discuss together, and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。