The team says it is working to contain the impact and will restore services after applying a software fix.
An incident report will be released once the situation is resolved, the team added.
The team said the incident was "a drain, not a mint," leaving total supply unchanged, and that no assets other than TAC were affected.
TAC expects to publish a technical post-mortem and relaunch plan on Aug. 25, with the latter aimed at normalizing TAC balances and applying the necessary Cosmos fixes.
TAC, a Layer-1 blockchain built to connect Ethereum-compatible applications with TON and Telegram users, halted block production on Aug. 22 after detecting what the team described as a vulnerability affecting the token supply on its Cosmos EVM layer.
- But TAC has so far disclosed few details about what actually happened.
- The team hasn't publicly specified how many tokens were affected, identified the exploit transaction or explained which component of the network was targeted.
- On-chain researcher Rarma pointed out in a Sunday post on X that they traced the attack and found that the exploiter drained about 3 billion TAC from the network's bonded token pool, an account used by Cosmos-based chains to hold tokens delegated to validators.
Same bug, different chain
According to Rarma's analysis, the attacker then moved the funds out of the affected system within roughly 95 seconds. TAC hasn't confirmed either the amount or the sequence of transactions, so the figures remain based on the researcher's reconstruction of the attack.
Rather than being a TAC-specific flaw, the vulnerability appears to stem from shared Cosmos EVM software that allows Ethereum-style smart contracts to interact with native Cosmos functions such as staking.
KiiChain, another Cosmos EVM network, was exploited and halted on Aug. 22, and reporting based on its incident analysis says MANTRA, TAC and KiiChain were targeted using nearly identical staking and vesting mechanics.
In the described attack, a specially prepared smart contract can interact with Cosmos staking functionality in a way that causes the system to incorrectly calculate how many tokens are available.
The resulting accounting error can then be combined with other calls to move tokens that the attacker should not be able to access.
A vulnerability spreads across chains
The incidents raise the possibility that attackers developed a repeatable exploit for chains running the vulnerable Cosmos EVM code rather than independently discovering separate bugs on each network.
MANTRA halted its chain on Aug. 20 after detecting an exploit involving its Cosmos EVM module. The project later said the incident had affected two addresses and that no user funds were exploited before the network was stopped.
- Block production later resumed after validators deployed patched software.
KiiChain was hit two days later. Its team said the incident originated from a Cosmos EVM vulnerability and halted the network while developers worked on a fix. Reporting on its subsequent incident analysis estimated that about 148 million KII were taken across multiple exploit attempts.
As of Monday, Aug. 24, the project hasn't published a post-mortem or confirmed the amount of TAC affected, leaving roughly 3 billion tokens and the precise exploit mechanics reliant on independent on-chain analysis.
- The Aug. 22 incident is separate from TAC's bridge exploit in May, when an attacker bypassed verification checks in its TON-to-TAC bridge and caused unbacked assets to be issued on TAC.
- The project later put losses from that attack at more than $2.8 million.