An attacker drained roughly 5,700 escrowed NFTs from the Injective-based marketplace and dumped most of them for pennies
Talis Protocol, an NFT marketplace built primarily on the Injective blockchain, has frozen new listings and auctions. An attacker exploited its smart contracts and walked off with about 5,700 escrowed NFTs.
The haul was small. On-chain data shows the attacker made about 445 INJ, worth roughly $3,100 at the time. For a heist that touched thousands of digital assets, that is the crypto equivalent of breaking into a jewelry store and leaving with the display cases.
How the exploit unfolded
The incident was reported on October 31, 2026. The attacker targeted vulnerabilities in two parts of the platform: the marketplace contract and the auction contract.
Both contracts held NFTs in escrow. Once the roughly 5,700 NFTs were withdrawn, the attacker sold them into open collection offers. Collection offers are standing bids on any item from a given collection, so the attacker could unload assets instantly without waiting for a buyer to show up.
Most of the NFTs sold for around 2 cents each, mainly to bid bots. These are automated programs that sit on low offers and scoop up anything sold into them.
That explains the modest payout. The stolen NFTs may have carried far higher value to their owners, but the attacker converted them at fire-sale prices. The result is a lot of damage for very little profit.
Talis moves to contain the damage
Talis responded by halting all new listings and auctions on its platform. It also paused operations on other blockchain networks it supports as a precaution, even though the attack centered on Injective.
The more notable step is the cleanup. Talis said it plans to return the stolen NFTs to their owners. It has also begun the process of returning more than 26,000 NFTs to their rightful owners.
That second figure is much larger than the number taken in the exploit. It suggests Talis is pulling escrowed assets out of the affected contracts more broadly, not just chasing the items the attacker touched.
The company has also said it intends to compensate bidders. A patched version of its contract is now under pre-deployment review. Talis plans to publish a list of the affected NFTs.
Users have been warned against buying the affected NFTs while the situation is sorted out. A full postmortem is expected.
Background on Talis Protocol
Talis was founded in 2021. It raised $2.35 million shortly after launch. The platform built its footprint on Injective, a blockchain whose native token is INJ. That is the currency the attacker received for the stolen NFTs. Talis also operates on other chains, which is why the pause extended beyond Injective.
What this means
For Talis users, the immediate question is recovery. The company has committed to restoring NFTs and compensating bidders, but the details of the compensation and restoration plan are still being developed. Until the affected list is published, holders may not know exactly where their assets stand.
The bid bots add an awkward wrinkle. Those automated buyers acquired many of the stolen NFTs at roughly 2 cents apiece. How Talis handles assets now sitting in those wallets will be a test of whether its return plan can work in practice.
There are three things to watch. First, the postmortem, which should show whether the flaw was a simple logic error or something more complex. Second, the review of the patched contract, which determines when listings and auctions can resume. Third, how quickly the affected NFTs actually make their way back to their original owners.
