TAC network frozen 10+ days after 1.26B TAC bailout

The TAC network has remained halted at block 24,671,475 for more than 10 days after an Aug. 22 exploit emptied the protocol’s bonded staking pool. The TAC Foundation plans to replace 1,258,228,061.40 TAC from treasury reserves to cover tokens sold by the attacker.

A single transaction reduced the bonded pool to zero while not changing the total token supply, leaving delegations without the tokens that backed them. TAC reported the drain at 2,985,651,403.40 TAC, about 28.6% of the supply. Block production has not resumed since Aug. 22.

An upstream advisory traced the vulnerability to a mismatch between two balance records used by the chain software. The EVM StateDB tracked only spendable balances while the Cosmos SDK ledger tracked locked vesting tokens that could be delegated. When a delegation exceeded an account’s spendable balance, an unchecked subtraction wrapped toward a very large value near 2^256. A subsequent overflow operation allowed an attacker to zero a victim account while retaining the victim’s legitimate tokens. The advisory classified the flaw as critical and identified vulnerable Cosmos EVM releases as versions below 0.6.2, plus 0.7.0 and 0.7.1.

Timeline details in the advisory show the bug reached a bounty program on April 25, was patched on the main branch on May 15 and backported into releases on Aug. 19. A public description of the exploit path appeared Aug. 20. TAC reported it had provided a maintainer analysis of related defects in July that received no acknowledgement.

The attacker moved and sold part of the stolen supply across chains. On BNB Chain, 1,208,329,197 TAC was swapped for 950,293 USDT. On TON, 49.9 million TAC was sold for 55,481 USDT. The reported proceeds total about 1,005,774 USDT. TAC also reported 1,662,322,353 incident-associated TAC currently resides in addresses on BNB Chain and remains unresolved.

The proposed recovery relies on a targeted state edit at the halt block rather than a full rollback. The edit would remove 65,100,989 incident-linked TAC that are frozen on the TAC chain and restore the bonded pool and delegator balances. The Foundation will replace 1,258,228,061.40 TAC from treasury reserves to cover tokens that were sold. TAC stated the edit would preserve 7,772 legitimate transactions from 218 unrelated addresses and would not rewind the chain’s history. Bridging and redemption functions remain disabled while the incident is addressed.

Restarting the network requires validators to adopt a patched software binary, resume block production and execute the planned state edit. The treasury replacement covers the portion of tokens that were sold off-network; the larger attacker-held balance on BNB Chain remains unresolved. TAC is an EVM-compatible Layer 1 connected to the TON ecosystem, and the incident involved overlapping balance records between different ledger layers.