TAC Network Halt Continues After Exploit Drains Bonded Staking Pool

The TAC network halt continues at block 24,671,475, more than 10 days after an exploit emptied the bonded staking pool. The network is an EVM-compatible Layer 1 connected to the TON ecosystem. An RPC query by CryptoSlate at 2:33 a.m. UTC still showed the final block from Aug. 22, meaning normal block production had not resumed.

The network's Sept. 1 postmortem put the drain at 2,985,651,403.40 TAC, or 28.6% of supply. TAC said one transaction reduced the bonded pool to zero without changing total token supply, leaving the chain's delegation records without the tokens that backed them.

The upstream Cosmos EVM advisory attributed the attack path to a mismatch between two balance records. The EVM StateDB tracked only an account's spendable tokens, while the Cosmos SDK ledger also tracked locked vesting tokens that could be delegated. Delegating more than the spendable amount caused an unchecked subtraction to wrap toward an enormous number close to 2^256.

Cosmos Labs said a second overflow operation then let an attacker zero a victim account while retaining its legitimate tokens. TAC identified the protocol-controlled staking pool as the victim account on its network. The advisory classed the flaw as critical and said Cosmos EVM versions below 0.6.2, plus versions 0.7.0 and 0.7.1, were vulnerable.

The disclosure trail predates the attack. Cosmos Labs' postmortem said the bug reached its bounty program on April 25, was patched on the main branch May 15 and was backported into releases on Aug. 19. A Push Chain fork publicly described the path on Aug. 20. TAC separately said it sent a maintainer an analysis of two related defects in July without acknowledgement.

TAC network halt recovery leaves BNB Chain balance unresolved

TAC said the attacker sold 1,208,329,197 TAC on BNB Chain for 950,293 USDT and another 49.9 million TAC on TON for 55,481 USDT. The reported proceeds total 1,005,774 USDT.

The proposed recovery splits the drained pool three ways. A targeted state edit would remove 65,100,989 incident-linked TAC frozen on TAC. Another 1,662,322,353 TAC remains in incident-associated BNB Chain addresses and will be handled separately. TAC said the remaining 1,258,228,061.40 TAC, representing tokens sold from the pool, would be replaced in full from TAC Foundation treasury reserves.

Unlike a rollback, the proposed edit would correct specified balances at the halt block without rewinding the chain. TAC said that would restore the bonded pool and delegator balances while preserving 7,772 legitimate transactions from 218 unrelated addresses.

Ending the TAC network halt still depends on validators adopting TAC's patched binary, resuming block production and executing the edit. Bridging and redemption remain disabled, and TAC has not settled how the 1.662 billion TAC on BNB Chain will be treated. The treasury commitment therefore addresses the sold-token shortfall, not the larger attacker-held balance outside the network.