TAC Blockchain Stalled Over 10 Days After Exploit Drains 28.6% of Token Supply

The TAC network, an EVM‑compatible Layer 1 linked to the TON ecosystem, has remained frozen since block 24,671,475, more than ten days after a single transaction drained the bonded staking pool.

Exploit Details

The attack removed 2,985,651,403.40 TAC, equivalent to 28.6 % of the token supply, from the staking pool without altering the total token supply. The vulnerability stemmed from a mismatch between the Cosmos SDK ledger and the EVM StateDB balance records. Delegating more than the spendable amount caused an unchecked subtraction that wrapped around a 2^256 limit, allowing the attacker to zero a victim account while retaining its legitimate tokens.

Technical Background

The flaw affected Cosmos EVM versions below 0.6.2 and versions 0.7.0 and 0.7.1. The bug was reported to the Cosmos Labs bounty program on April 25, patched on the main branch on May 15, and back‑ported to releases on August 19. A public description of the attack path appeared on August 20.

Impact and Recovery Plan

The attacker sold 1,208,329,197 TAC on BNB Chain for 950,293 USDT and 49.9 million TAC on TON for 55,481 USDT, totaling 1,005,774 USDT in proceeds. TAC proposes a three‑way recovery:

• Remove 65,100,989 TAC linked to the incident from the frozen state.
• Handle 1,662,322,353 TAC held in BNB Chain addresses separately.
• Replace the remaining 1,258,228,061.40 TAC, representing sold tokens, from the TAC Foundation treasury.

The proposed state edit would correct balances at the halt block without rewinding the chain, preserving 7,772 legitimate transactions from 218 unrelated addresses. Resumption of block production depends on validators adopting the patched binary and executing the edit. Bridging and redemption functions remain disabled, and the treatment of the 1.662 billion TAC on BNB Chain is still unresolved.