TAC Blockchain Frozen for Over 10 Days After Massive Exploit

The TAC blockchain has been frozen for over 10 days due to a massive exploit that drained 2.985 billion tokens from its bonded staking pool, accounting for 28.6% of its total supply.

According to the Cosmos EVM advisory, the attack path was caused by a mismatch between two balance records, leading to an unchecked subtraction and ultimately allowing an attacker to zero out the protocol-controlled staking pool's account while retaining its legitimate tokens.

The flaw, which was attributed to Cosmos EVM versions below 0.6.2 and 0.7.0 and 0.7.1, was patched on May 15 and backported into releases on August 19, but it appears that the attacker exploited a related defect in July.

The TAC network halt recovery plan proposes to replace 1.258 billion tokens from the pool with funds from the TAC Foundation treasury reserves, while the remaining 1.662 billion tokens held by incident-associated BNB Chain addresses will be handled separately.