Audit log

Every state-changing event for TAC Chain: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-11 23:04:41Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 446,277,330

   sig

   4DV2fgz1tLmw…hCStmxJ6copyexplorer ↗

   hash

   6C3afGo33dp3…gHhhUZz6copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (23862 B) ▸

   {"actor":"system:backfill","investigation_id":"f9d32bb3-64e8-4b04-8f33-cddac0113faa","kind":"publish","page_slug":"tac-chain","published_at":"2026-09-11T23:04:41.589Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"TAC Chain","sections":[{"content":"On August 22, 2026, at 19:46:37 UTC, an attacker exploited a critical integer underflow vulnerability in the shared Cosmos EVM module used by TAC Chain and several other networks. The exploit drained the network's bonded staking pool of 2,985,651,403.40 TAC tokens — representing 28.6% of the total token supply, valued at approximately $7.5 million at the time of the attack.\n\nThe technical mechanism, described in TAC's September 1 postmortem, involved a mismatch between two internal balance records: the EVM StateDB, which tracked only an account's spendable tokens, and the Cosmos SDK ledger, which also tracked locked vesting tokens eligible for delegation. By delegating an amount exceeding the spendable balance, an attacker could trigger an unchecked subtraction that wrapped toward approximately 2^256 — a maximum unsigned integer value. The attacker deployed a contract exploiting this underflow, which then caused the bonded staking pool's balance to overflow to zero while crediting the pool's original balance to the attack contract. Total token supply remained unchanged throughout the operation; existing tokens were illicitly transferred, not newly minted.\n\nWithin 95 seconds of the initial drain, the attacker executed two bridge transfers moving approximately 2.986 billion TAC to BNB Chain. The attacker subsequently sold 1,208,329,197 TAC on BNB Chain for approximately 950,293 USDT and 49.9 million TAC on TON for approximately 55,481 USDT, netting total proceeds of approximately $1,005,774 USDT. Block production stopped at 23:58:11 UTC, approximately four hours after the exploit, when validators halted the chain at block 24,671,475. As of the date of this investigation (September 11, 2026), the chain remained frozen more than ten days after the attack.","heading":"August 2026 Cosmos EVM Staking Pool Exploit","severity":"critical","sources":[{"credibility":2,"name":"TAC blockchain remains frozen for over 10 days after a massive exploit forces a 1.26 billion token bailout — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"credibility":2,"name":"Blockchain Hack Drains 28.6% of TAC Supply From Staking Pool — Coindoo","type":"news_article","url":"https://coindoo.com/blockchain-hack-drains-28-6-of-tac-supply-from-staking-pool/"},{"credibility":2,"name":"TAC Blockchain Confirms Cosmos EVM Precompile Exploit; $7.5M Drained — BingX Flash News","type":"news_article","url":"https://bingx.com/en/flash-news/post/tac-blockchain-pauses-network-after-cosmos-evm-precompile-exploit-steals-m-and-b-tac-tokens"},{"credibility":2,"name":"TAC official statement on X (TacBuild)","type":"social_media","url":"https://x.com/TacBuild/status/2091873937655574938"},{"credibility":3,"name":"TAC network halt: Foundation pledges 1.26B-token fix — BitcoinEthereumNews","type":"news_article","url":"https://bitcoinethereumnews.com/tech/tac-network-halt-foundation-pledges-1-26b-token-fix/"}]},{"content":"The vulnerability (CVE identifier GHSA-7g4w-cg88-2cq2) was reported to Cosmos Labs' bug bounty program on April 25, 2026. Cosmos Labs initially assessed that the flaw posed no risk to live production networks, incorrectly concluding that only non-18-decimal configurations were affected. A patch was deployed to the main branch on May 15, 2026, but without a coordinated private disclosure to affected chain operators.\n\nOn August 13, 2026, Cosmos Labs internally confirmed that all Cosmos EVM chains were vulnerable regardless of decimal configuration — nine weeks after the original report. Despite this updated assessment, Cosmos Labs used its standard 'silent patch' release process rather than activating emergency private distribution channels. Patched releases (v0.6.2 and v0.7.2) were published on August 19 with generic security notes but without disclosing the specific vulnerability. No advance warning was provided to TAC Chain or other affected networks.\n\nAccording to reporting by The Hacker News, Cosmos Labs' own security policy states: 'When an issue presents an immediate or network-wide risk, Cosmos Labs will initiate emergency mitigations, private fix distribution, or coordinated upgrades before any public disclosure occurs.' Cosmos Labs later acknowledged that eleven Cosmos EVM deployments had never registered security contacts, pointing to a systemic gap in the coordinated disclosure process. On August 29, 2026, Cosmos Labs publicly acknowledged that its initial assessment was incorrect and that the silent-patch approach was insufficient given the confirmed universal risk.","heading":"Upstream Disclosure Failure by Cosmos Labs","severity":"high","sources":[{"credibility":2,"name":"Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"credibility":1,"name":"Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross-chain attacks — Crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"credibility":2,"name":"Cosmos Labs Confirms Cosmos EVM Incident as 3 Chains Disclose Impact — Yahoo Finance/Finance Feeds","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html"}]},{"content":"TAC proposed a targeted state edit rather than a full chain rollback to restore user balances while preserving the approximately 7,772 legitimate transactions that occurred before the chain halted. The recovery addresses the drained 2,985,651,403.40 TAC in three parts: approximately 65.1 million TAC that remained frozen on the TAC network would be removed via the state edit; approximately 1.258 billion TAC sold by the attacker (totaling approximately $1.006 million in USDT proceeds) would be replaced from TAC Foundation treasury reserves; and approximately 1.662 billion TAC held in attacker-controlled addresses on BNB Chain was, as of the time of reporting, still without a settled treatment plan.\n\nAs of September 11, 2026, the network remained halted. Restart is contingent on validators adopting the patched binary and approving the state edit through governance. No confirmed restart date had been publicly announced. The Foundation's pledge to replace sold tokens addresses only the portion of the theft that was liquidated; the disposition of the 1.662 billion TAC still held on BNB Chain represents a continued unresolved risk to the token's circulating supply and price.","heading":"Recovery Plan and Chain Restart Status","severity":"high","sources":[{"credibility":2,"name":"TAC blockchain remains frozen for over 10 days after a massive exploit forces a 1.26 billion token bailout — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"credibility":3,"name":"TAC network halt: Foundation pledges 1.26B-token fix — BitcoinEthereumNews","type":"news_article","url":"https://bitcoinethereumnews.com/tech/tac-network-halt-foundation-pledges-1-26b-token-fix/"},{"credibility":2,"name":"TAC chain halt follows supply exploit as restart remains unclear — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/evm-network-halts-block-production-after-supply-exploit-as-ton-connection-remains-dark/"}]},{"content":"On May 11, 2026, the TON-to-TAC asset bridge suffered a separate code-hash verification exploit. An attacker deployed a counterfeit jetton wallet contract that mimicked legitimate USDT, bypassing the sequencer's validation controls. The sequencer software failed to verify both the code hash of incoming TON jetton wallet messages and the expected minter behind the wallet. As a result, counterfeit deposit messages were accepted, unbacked token equivalents were issued on TAC, and genuine assets locked on TON were released. The attack affected USDT ($2,433,655), BLUM ($403,201), and tsTON ($17,630), for a total protocol loss of approximately $2,854,486.\n\nFollowing intervention by the Seal911 security team and law enforcement tracing, approximately 80.2% of affected funds ($2,290,687.90) were recovered. The exploiter retained approximately 10% as a white-hat bounty, which TAC formally accepted. TAC classified the incident as white-hat activity and reopened bridge transfers on June 10, 2026. TAC Foundation treasury covered any remaining shortfall. Following the exploit, TAC implemented jetton-wallet code-hash verification, minter validation checks, per-minter rate limits, and expanded real-time monitoring.","heading":"May 2026 Bridge Exploit","severity":"high","sources":[{"credibility":2,"name":"Post-Mortem Report: TAC Bridge — TAC official blog","type":"official","url":"https://tac.build/blog/post-mortem-report-tac-bridge"},{"credibility":2,"name":"TAC labels $2.8M bridge exploit a white hat incident as hacker claims 10% bounty — MEXC News","type":"news_article","url":"https://www.mexc.com/news/1093414"},{"credibility":2,"name":"TAC declares $2.8M exploit as white hat incident after hacker refunds loot — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/tac-white-hat-incident-hacker-refund/"}]},{"content":"TAC engaged Halborn Security to perform a security assessment of its Cosmos EVM module, which commenced on June 16, 2025. The audit focused on custom changes made to the Cosmos module. Halborn identified one improvement recommendation — implementing checked arithmetic conversions to prevent panic reverts — which the TAC team addressed. The Halborn audit did not identify the integer underflow vulnerability in the upstream Cosmos EVM module that was later exploited in August 2026. This is consistent with the vulnerability's origin in the shared upstream codebase rather than TAC's custom modifications, though the audit's scope may not have extended to a full review of the shared module dependencies.\n\nThe August 2026 exploit exploited a vulnerability in upstream shared infrastructure (the Cosmos EVM module maintained by Cosmos Labs), not in TAC-specific code. TAC's own X post confirmed: 'The defect is not in TAC-specific code. It sits in the shared Cosmos EVM module, and several other chains [were affected].'","heading":"Security Audit History","severity":"medium","sources":[{"credibility":1,"name":"Cosmos EVM Audit — Halborn Security (TAC)","type":"research","url":"https://www.halborn.com/audits/tac/cosmos-evm-edf06b"},{"credibility":2,"name":"TAC official statement on X (TacBuild)","type":"social_media","url":"https://x.com/TacBuild/status/2091873937655574938"}]},{"content":"TAC's mainnet launched on approximately July 15, 2025. Following the launch, the TAC token traded at approximately $0.0248 before retreating. The token reached an all-time high of approximately $0.06715 and has since declined significantly. Prior to the August 2026 exploit, TAC was already trading near historic lows following an unexplained 82% price decline in July 2026. On the day of the exploit, August 22, the token reached a low of approximately $0.001129. Following news of the Foundation's 1.26 billion token recovery pledge, the token rebounded approximately 53%, trading between $0.001626 and $0.001894. As of approximately September 2026, TAC was approximately 97.4% below its all-time high and carried a market capitalization of approximately $8.3 million, ranked approximately #1007 on CoinMarketCap.\n\nThe issuance of approximately 1.258 billion tokens from the Foundation treasury to cover the exploit shortfall represents a significant inflationary event that may affect token value upon network restart.","heading":"Token Price and Market Context","severity":"medium","sources":[{"credibility":2,"name":"TAC climbs off record low after exploit forces chain halt — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/tac-climbs-after-exploit-forces-chain-halt/"},{"credibility":2,"name":"TAC Token Rallies 50% as Mainnet Launches — The Defiant","type":"news_article","url":"https://thedefiant.io/news/defi/tac-mainnet-launch-to-bring-defi-back-to-telegram"},{"credibility":2,"name":"TAC Price — CoinGecko","type":"other","url":"https://www.coingecko.com/en/coins/tac"}]},{"content":"TAC Chain, formally the Telegram Application Chain, is a Cosmos EVM-compatible Layer 1 blockchain designed to bridge Ethereum's DeFi ecosystem with The Open Network (TON) and Telegram's user base. It is built using the Cosmos SDK with EVM compatibility via the Cosmos EVM module, enabling deployment of Solidity smart contracts and cross-chain interoperability with TON via a dedicated messaging layer. Co-founder Marco Monaco previously co-founded Linea, an Ethereum rollup built at Consensys. The project attracted major Ethereum DeFi protocols including Curve, Morpho, and Euler to deploy on the network, and reported over $800 million in total value locked during a liquidity campaign in partnership with Turtle Club. The network launched mainnet in July 2025 and positioned itself around Telegram's approximately one billion monthly active users as a distribution channel for DeFi applications.","heading":"Protocol Overview and Background","severity":"low","sources":[{"credibility":2,"name":"TAC mainnet launch aims to bridge Ethereum DeFi to TON — Blockworks","type":"news_article","url":"https://blockworks.com/news/tac-mainnet-launch-ethereum-ton"},{"credibility":3,"name":"What Is TAC Protocol (TAC)? The EVM Layer for TON and Telegram — Phemex Academy","type":"other","url":"https://phemex.com/academy/what-is-tac-protocol-ton-evm"},{"credibility":2,"name":"EVM on TON: TAC Founder Marco Monaco and the Future of Interoperability — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/evm-on-ton-tac-founder-marco-monaco-and-the-future-of-interoperability/"},{"credibility":3,"name":"TAC Network — IQ.wiki","type":"other","url":"https://iq.wiki/wiki/tac-network"}]}],"sources_used":[{"credibility":2,"name":"TAC blockchain remains frozen for over 10 days after a massive exploit forces a 1.26 billion token bailout — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"credibility":1,"name":"Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"credibility":2,"name":"Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"credibility":2,"name":"TAC Blockchain Hit by Cosmos EVM Module Exploit, $7.5M Stolen — KuCoin Flash","type":"news_article","url":"https://www.kucoin.com/news/flash/tac-blockchain-hit-by-cosmos-evm-module-exploit-7-5m-stolen"},{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross-chain attacks — Crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"credibility":2,"name":"Cosmos Labs Confirms Cosmos EVM Incident as 3 Chains Disclose Impact — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html"},{"credibility":2,"name":"Post-Mortem Report: TAC Bridge — TAC official blog","type":"official","url":"https://tac.build/blog/post-mortem-report-tac-bridge"},{"credibility":2,"name":"TAC official statement on X (TacBuild)","type":"social_media","url":"https://x.com/TacBuild/status/2091873937655574938"},{"credibility":2,"name":"Blockchain Hack Drains 28.6% of TAC Supply From Staking Pool — Coindoo","type":"news_article","url":"https://coindoo.com/blockchain-hack-drains-28-6-of-tac-supply-from-staking-pool/"},{"credibility":2,"name":"TAC climbs off record low after exploit forces chain halt — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/tac-climbs-after-exploit-forces-chain-halt/"},{"credibility":2,"name":"TAC declares $2.8M exploit as white hat incident after hacker refunds loot — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/tac-white-hat-incident-hacker-refund/"},{"credibility":1,"name":"Cosmos EVM Audit — Halborn Security (TAC)","type":"research","url":"https://www.halborn.com/audits/tac/cosmos-evm-edf06b"},{"credibility":2,"name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks"},{"credibility":2,"name":"TAC mainnet launch aims to bridge Ethereum DeFi to TON — Blockworks","type":"news_article","url":"https://blockworks.com/news/tac-mainnet-launch-ethereum-ton"},{"credibility":2,"name":"Cosmos EVM chains told to halt after security incident — Crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-chains-told-to-halt-after-security-incident/"},{"credibility":2,"name":"EVM on TON: TAC Founder Marco Monaco and the Future of Interoperability — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/evm-on-ton-tac-founder-marco-monaco-and-the-future-of-interoperability/"},{"credibility":2,"name":"TAC Price — CoinGecko","type":"other","url":"https://www.coingecko.com/en/coins/tac"},{"credibility":3,"name":"TAC network halt: Foundation pledges 1.26B-token fix — BitcoinEthereumNews","type":"news_article","url":"https://bitcoinethereumnews.com/tech/tac-network-halt-foundation-pledges-1-26b-token-fix/"}],"summary":"TAC Chain (Telegram Application Chain) is a Cosmos EVM-compatible Layer 1 blockchain designed to bridge Ethereum DeFi with TON and Telegram's user base, which launched its mainnet in July 2025. On August 22, 2026, an attacker exploited a balance-synchronization integer underflow in the shared Cosmos EVM module, draining approximately 2.986 billion TAC tokens (28.6% of total supply, worth roughly $7.5 million at the time) from the network's staking pool; validators halted the chain at block 24,671,475. This was TAC's second significant security incident in 2026, following a $2.8 million bridge exploit in May 2026 that was ultimately classified as a white-hat recovery.","timeline":[{"date":"2025-07-15","event":"TAC Chain mainnet launched, bridging Ethereum DeFi to TON and Telegram.","source":"The Defiant","source_url":"https://thedefiant.io/news/defi/tac-mainnet-launch-to-bring-defi-back-to-telegram"},{"date":"2026-04-25","event":"Integer underflow vulnerability in the Cosmos EVM module reported to Cosmos Labs' bug bounty program. Cosmos Labs incorrectly assessed it as posing no risk to live production networks.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"date":"2026-05-11","event":"TON-to-TAC bridge suffered a code-hash verification exploit; approximately $2.854 million in assets drained. Approximately 80.2% later recovered; incident reclassified as white-hat.","source":"TAC official blog","source_url":"https://tac.build/blog/post-mortem-report-tac-bridge"},{"date":"2026-05-12","event":"TAC accepted exploiter's offer to return bridge funds in exchange for a 10% white-hat bounty.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/tac-white-hat-incident-hacker-refund/"},{"date":"2026-05-15","event":"Cosmos Labs deployed patch for the Cosmos EVM vulnerability to main branch, without private coordinated disclosure to affected chain operators.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"date":"2026-06-10","event":"TAC reopened bridge transfers between TON and TAC following the May bridge exploit recovery.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/tac-white-hat-incident-hacker-refund/"},{"date":"2026-08-13","event":"Cosmos Labs internally confirmed that all Cosmos EVM chains were vulnerable to the April-reported bug, regardless of decimal configuration. No emergency disclosure was issued to chain operators.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"date":"2026-08-19","event":"Cosmos Labs released patched versions v0.6.2 and v0.7.2 with generic security notes and no specific vulnerability disclosure. TAC and other operators were not privately alerted.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"date":"2026-08-20","event":"Push Chain fork publicly described the vulnerability. Exploitation began across six Cosmos EVM chains, starting with MANTRA at approximately 19:06 UTC.","source":"Crypto.news","source_url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"date":"2026-08-22","event":"At 19:46:37 UTC, attacker exploited the Cosmos EVM integer underflow vulnerability on TAC Chain, draining 2,985,651,403.40 TAC (28.6% of supply) from the staking pool. Within 95 seconds, stolen tokens were bridged to BNB Chain. Validators halted the network at block 24,671,475.","source":"CryptoSlate","source_url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"date":"2026-08-24","event":"Cosmos Labs confirmed the security incident affecting KiiChain, TAC, and MANTRA and urged all Cosmos EVM chains to halt validators.","source":"Yahoo Finance / FinanceFeeds","source_url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html"},{"date":"2026-08-29","event":"Cosmos Labs publicly acknowledged that its April 2026 assessment was incorrect and that the standard silent-patch process was insufficient for a vulnerability of universal network-wide risk.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-08-29-cosmos-labs-says-it-wrongly-cleared-the-bug-behind-a-5-7-million-six-chain-hack-413061"},{"date":"2026-09-01","event":"TAC published a detailed postmortem analysis of the August 22 exploit, disclosing three combined upstream defects including the staking precompile underflow.","source":"CryptoSlate","source_url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"date":"2026-09-02","event":"TAC network remained frozen at block 24,671,475, more than 10 days after the exploit. Foundation's pledge to replace 1.258 billion TAC announced; treatment of 1.662 billion TAC on BNB Chain remained unsettled.","source":"CryptoSlate","source_url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d5918517-681d-45f4-bc12-698f33a31e2acopy