Talis, an NFT marketplace on the Injective network, said roughly 5,700 NFTs were taken after an attacker exploited weaknesses in its marketplace and auction smart contracts. According to the platform, the attacker was able to remove listed NFTs without authorization and then sell them into existing buy orders.

The incident was disclosed alongside another security issue in the wider Web3 sector involving Solana’s Seeker dApp store. In Talis’s case, the company has already frozen key marketplace functions, moved to return assets still under its control, and said further remediation steps are being prepared.

How the Talis exploit worked

Talis said the theft was tied to vulnerabilities in the smart contracts that handled marketplace listings and auctions on Injective. The attacker allegedly used those flaws to take NFTs that had been listed for sale or placed in auctions, even though no authorized transfer should have occurred.

After obtaining the assets, the attacker sold them into buy orders that were already sitting on the marketplace. Based on Talis’s estimate, about 5,700 NFTs were affected by the exploit. The company did not provide a breakdown of individual collections or values in the source report.

Immediate containment measures

In response, Talis stopped new NFT listings and auctions on the affected marketplace. It also said more than 26,000 NFTs that were being held in its smart contracts were returned to their original owners as part of its emergency response.

The platform added that new listings and auctions on other networks were also temporarily suspended. That broader pause was described as a precaution aimed at preventing any additional losses while the scope of the contract issue was being addressed.

Recovery and compensation plans

Talis said it is preparing an updated smart contract to replace the vulnerable setup. Alongside that technical fix, the marketplace said it is developing measures both to return stolen NFTs and to compensate buyers affected by the incident.

The company also said it plans to publish a list of the NFTs impacted by the exploit. That list is expected to be part of the next stage of the recovery process, though the source article did not give a date for when it will be released.

Broader security backdrop

The Talis incident was reported at the same time as a separate breach affecting Solana’s mobile ecosystem. In that case, a malicious app called SKR Claim appeared on the Solana Seeker dApp store after a compromise of the developer portal and remained visible for about an hour before it was removed.

That app reportedly asked users to enter wallet seed phrases, a prompt that can enable theft of digital assets. Seeker said it fixed the vulnerability and removed the app, but the number of affected users and the scale of any losses were still unclear in the source report.

For Talis, the next confirmed steps are an updated contract, a published list of affected NFTs, and a restitution plan covering stolen assets and impacted buyers. Until then, listing and auction activity remains curtailed as the platform works through remediation.

Source: en.bloomingbit.io