The TAC network has been halted for more than ten days, stuck at block 24,671,475 after an exploit emptied the bonded staking pool. The attack drained 2,985,651,403.40 TAC — roughly 28.6% of the total supply — and the chain hasn't produced a block since.
How the exploit worked
The root cause sits in a mismatch between two ledgers. The EVM StateDB, which tracks spendable tokens, and the Cosmos SDK ledger, which tracks locked vesting tokens that could be delegated, disagreed on what was actually available. That mismatch allowed an unchecked subtraction to wrap around to roughly 2^256, effectively creating tokens out of thin air.
A second overflow operation let the attacker zero out a victim account while keeping its legitimate tokens. That victim was the protocol-controlled staking pool. The critical flaw affects Cosmos EVM versions below 0.6.2, plus versions 0.7.0 and 0.7.1.
A bug report that went unanswered
The vulnerability was reported to Cosmos Labs' bounty program on April 25. It was patched on the main branch May 15 and backported into releases on Aug. 19. A Push Chain fork publicly described the attack path the next day, Aug. 20.
TAC had sent a maintainer an analysis of two related defects in July, but got no acknowledgement. The public disclosure came before TAC could deploy a fix, leaving the network exposed.
What the attacker got away with
The attacker sold 1,208,329,197 TAC on BNB Chain for 950,293 USDT, and another 49.9 million TAC on TON for 55,481 USDT. Total proceeds came to about 1,005,774 USDT. The bulk of the stolen tokens — 1.66 billion TAC — still sits in BNB Chain addresses.
The recovery plan and its gaps
TAC's proposed recovery plan has three parts. First, a state edit to remove 65,100,989 incident-linked TAC frozen on TAC. Second, separate handling of the 1,662,322,353 TAC held in BNB Chain addresses. Third, replacement of the 1,258,228,061.40 TAC that was sold, funded from TAC Foundation treasury reserves.
The state edit would correct balances at the halt block without rewinding the chain. That preserves 7,772 legitimate transactions from 218 unrelated addresses. But ending the halt depends on validators adopting TAC's patched binary, resuming block production, and executing the edit. Bridging and redemption remain disabled until then.
What's still unresolved is the 1.66 billion TAC on BNB Chain. TAC hasn't said how that will be treated, and the treasury commitment only covers the sold-token shortfall — not the larger attacker-held balance outside the network. Validators now face a choice: adopt the patch and execute the edit, or leave the chain frozen indefinitely.
