Verify a decision

{"actor":"system:backfill","investigation_id":"a2385708-2a8e-4c36-b096-a159cceedcec","kind":"publish","page_slug":"tac-network","published_at":"2026-09-16T23:30:15.409Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"TAC Network","sections":[{"content":"TAC Network, also known as TON Application Chain, is a Cosmos-based EVM-compatible Layer 1 blockchain whose stated purpose is to give Ethereum-native decentralized applications access to TON's and Telegram's user base, estimated at over one billion users. The project integrated Polygon's CDK and the Agglayer interoperability protocol. TAC raised $6.5 million in a seed funding round led by Hack VC and Symbolic Capital. Co-founders include Marco Monaco, who previously led crypto strategy at PwC Italy, and Pavel Altukhov, described as a long-standing participant in the TON ecosystem. Curve Finance founder Michael Egorov has also been reported as associated with the founding group. The mainnet launched in 2025 and the TAC token trades on BNB Chain as a BEP20 asset and on TON-native venues.","heading":"Project Overview","severity":"low","sources":[{"credibility":2,"name":"TAC raises $6.5 million to provide TON and Telegram users in-app access to EVM applications — The Block","type":"news_article","url":"https://www.theblock.co/post/325410/tac-seed-round-ton-telegram-evm"},{"credibility":2,"name":"TON Application Chain and Polygon team up to launch new TON L2 — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/ton-polygon-launch-new-ethereum-l2-tac"},{"credibility":2,"name":"EVM on TON: TAC Founder Marco Monaco and the Future of Interoperability — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/evm-on-ton-tac-founder-marco-monaco-and-the-future-of-interoperability/"},{"credibility":2,"name":"TAC mainnet launch aims to bridge Ethereum DeFi to TON — Blockworks","type":"news_article","url":"https://blockworks.com/news/tac-mainnet-launch-ethereum-ton"}]},{"content":"On August 22, 2026, an attacker exploited a critical vulnerability in the shared Cosmos EVM module (designated GHSA-7g4w-cg88-2cq2) to drain 2,985,651,403.40 TAC tokens — approximately 28.6% of the total token supply — from the network's bonded staking pool. The chain was halted at block 24,671,475 at 23:58:11 UTC the same day.\n\nThe vulnerability stemmed from a mismatch between two balance-tracking systems: the EVM StateDB recorded only an account's spendable tokens, while the Cosmos SDK ledger also tracked locked vesting tokens eligible for delegation. This discrepancy allowed an attacker to delegate more tokens to validators than an account legitimately held, causing an integer underflow that wrapped the balance toward the maximum value of 2^256-1. The inflated balance was then used to drain real tokens from protocol-controlled accounts.\n\nAccording to reporting by Startup Fortune and CryptoSlate, the attacker moved the full drained amount to BNB Chain within 95 seconds via bridge, and subsequently converted approximately 1,005,774 USDT worth of tokens across 55 swap transactions.\n\nTAC was one of at least six blockchains exploited through the same vulnerability between August 20 and August 25, 2026. Other confirmed victims include MANTRA (which lost approximately 720.9 million tokens worth about $3.6 million) and KiiChain (approximately 148 million KII tokens). The TAC Foundation issued an initial postmortem on September 1, 2026.","heading":"August 2026 Exploit: Cosmos EVM Vesting Vulnerability","severity":"critical","sources":[{"credibility":2,"name":"TAC Is Rewriting Its Own Token Supply To Strand The Hacker Who Drained It — Startup Fortune","type":"news_article","url":"https://startupfortune.com/tac-is-rewriting-its-own-token-supply-to-strand-the-hacker-who-drained-it/"},{"credibility":2,"name":"TAC blockchain remains frozen for over 10 days after a massive exploit forces a 1.26 billion token bailout — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross-chain attacks — crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"credibility":2,"name":"TAC chain halt follows supply exploit — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/evm-network-halts-block-production-after-supply-exploit-as-ton-connection-remains-dark/"},{"credibility":2,"name":"Blockchain Hack Drains 28.6% of TAC Supply From Staking Pool — Coindoo","type":"news_article","url":"https://coindoo.com/blockchain-hack-drains-28-6-of-tac-supply-from-staking-pool/"}]},{"content":"The vulnerability at the root of the TAC exploit was reported to Cosmos Labs via its bug bounty program on April 25, 2026. The team initially assessed that the flaw posed no risk, concluding it only affected networks using non-18-decimal token configurations. By August 13, 2026, Cosmos Labs had confirmed that all Cosmos EVM chains were vulnerable regardless of decimal configuration. Despite confirming widespread production risk, Cosmos Labs used its 'silent patch' process — typically reserved for non-fund-threatening issues — and released patched versions 0.6.2 and 0.7.2 on August 19, 2026, without vulnerability-specific warnings.\n\nReporting by The Hacker News noted that the first public exploitation of the vulnerability occurred within approximately 12 hours of the patched release, when MANTRA was attacked on August 20 at approximately 19:06 UTC. TAC and KiiChain were attacked on August 22. Cosmos Labs coordinated with approximately 40 networks during its response but provided only roughly 20 hours of advance notice — a timeframe MANTRA characterized as 'not realistic' for assessing and deploying state-breaking upgrades across 38 validators. Cosmos Labs also discovered that eleven blockchain deployments running the affected code had never registered security contacts.\n\nTAC was a victim of this upstream disclosure failure, not the perpetrator. The decision to use a silent patch for a vulnerability later confirmed to threaten funds across production chains is a matter of significant controversy in the Cosmos ecosystem.","heading":"Upstream Responsibility: Cosmos Labs Disclosure Failures","severity":"high","sources":[{"credibility":1,"name":"Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"credibility":2,"name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks"},{"credibility":2,"name":"Cosmos Labs Confirms Cosmos EVM Vulnerability — Yahoo Finance / BeInCrypto","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html"},{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross-chain attacks — crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"}]},{"content":"After halting block production at block 24,671,475, the TAC Foundation proposed a three-part recovery plan detailed in its September 1, 2026 postmortem:\n\n1. A targeted state edit to remove 65,100,989 incident-linked TAC tokens still frozen on the TAC chain.\n2. Separate treatment for 1,662,322,353 TAC remaining in attacker-linked BNB Chain addresses.\n3. Full replacement of 1,258,228,061.40 TAC — representing tokens sold by the attacker and converted to approximately $1,005,774 USDT — from TAC Foundation treasury reserves.\n\nAs of the period covered by available reporting, the chain remained halted for more than 10 days after the exploit. The restart was contingent on validators adopting TAC's patched binary and executing the state edit. The mainnet resumed block production from block 24,671,476 on September 4, 2026, according to Startup Fortune. The TAC native token initially fell to a record low following the exploit, then recovered approximately 53% from that low, though it remained materially below pre-exploit levels.","heading":"Recovery Response: Three-Part Plan and Extended Chain Halt","severity":"high","sources":[{"credibility":2,"name":"TAC blockchain remains frozen for over 10 days after a massive exploit forces a 1.26 billion token bailout — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"credibility":3,"name":"TAC network halt: Foundation pledges 1.26B-token fix — Bitcoinethereumnews","type":"news_article","url":"https://bitcoinethereumnews.com/tech/tac-network-halt-foundation-pledges-1-26b-token-fix/"},{"credibility":2,"name":"TAC Is Rewriting Its Own Token Supply To Strand The Hacker Who Drained It — Startup Fortune","type":"news_article","url":"https://startupfortune.com/tac-is-rewriting-its-own-token-supply-to-strand-the-hacker-who-drained-it/"},{"credibility":2,"name":"TAC climbs off record low after exploit forces chain halt — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/tac-climbs-after-exploit-forces-chain-halt/"}]},{"content":"On September 2, 2026, the TAC Foundation announced a migration of the entire BEP20 TAC token supply on BNB Chain to a new contract (0xb305E6954e4e0Cd021c06Ec355681abc8A00dbD7). A snapshot of all BNB Chain wallets and liquidity positions was taken at block 119,573,620 at 17:16 UTC. Under the migration terms, holders with TAC in self-custodied wallets or LP positions at the snapshot block received the new token on a 1:1 basis. The 1,662,322,353 TAC tokens held in attacker-associated addresses were deliberately excluded from the new contract.\n\nTrading of the new BEP20 contract went live on Binance Alpha on September 4, 2026 at 08:00 UTC. The TAC Foundation announced the migration on its official X account.\n\nThis approach — a unilateral supply rewrite executed by a centralized foundation — raises structural questions for token holders and market participants. While the stated goal was to strand the attacker's holdings and prevent further market-dumping of stolen tokens, the mechanism demonstrates that the TAC Foundation retains administrative authority to redeploy and redefine the canonical token supply on an external chain. The migration was not preceded by a governance vote of token holders. Observers have noted this sets a precedent for future supply modifications. Any pre-migration holder who did not hold tokens in a qualifying wallet at the snapshot block time — including those holding on exchanges not participating in the 1:1 swap — may have faced a different experience depending on their exchange or custodian's participation.","heading":"BNB Chain Token Migration and Supply Rewrite","severity":"high","sources":[{"credibility":2,"name":"TAC Is Rewriting Its Own Token Supply To Strand The Hacker Who Drained It — Startup Fortune","type":"news_article","url":"https://startupfortune.com/tac-is-rewriting-its-own-token-supply-to-strand-the-hacker-who-drained-it/"},{"credibility":3,"name":"TAC official X announcement on BNB Chain migration","type":"social_media","url":"https://x.com/TacBuild/status/2095242472230457749"},{"credibility":2,"name":"TAC blockchain remains frozen for over 10 days — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"}]},{"content":"Following the August 22 exploit, CryptoSlate reported that TAC's public communications did not initially identify the total amount drained, the dollar value of losses, the specific exploit transaction or block height, the vulnerable component, which user wallets were affected, user losses, or a restart timetable. The absence of granular public disclosure in the initial period of the incident drew criticism.\n\nAdditionally, reporting noted that the TAC Foundation had not addressed how native, wrapped, bridged, staked, exchange-held, and protocol-controlled TAC balances would each be handled in the state reconciliation process before validator consensus could be reached for a restart. The September 1 postmortem provided additional detail but came more than a week after the chain halt began.\n\nThese disclosure gaps are distinct from the upstream vulnerability and are attributable to TAC's own communications choices.","heading":"Transparency and Communication Concerns","severity":"medium","sources":[{"credibility":2,"name":"TAC chain halt follows supply exploit — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/evm-network-halts-block-production-after-supply-exploit-as-ton-connection-remains-dark/"},{"credibility":2,"name":"TAC blockchain remains frozen for over 10 days — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"}]}],"sources_used":[{"credibility":2,"name":"TAC Is Rewriting Its Own Token Supply To Strand The Hacker Who Drained It — Startup Fortune","type":"news_article","url":"https://startupfortune.com/tac-is-rewriting-its-own-token-supply-to-strand-the-hacker-who-drained-it/"},{"credibility":2,"name":"Cosmos EVM vulnerability drains MANTRA, TAC and KiiChain in cross-chain attacks — crypto.news","type":"news_article","url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"credibility":2,"name":"Cosmos Labs Confirms Cosmos EVM Vulnerability — Yahoo Finance / BeInCrypto","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html"},{"credibility":2,"name":"TAC blockchain remains frozen for over 10 days after a massive exploit forces a 1.26 billion token bailout — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"credibility":2,"name":"TAC chain halt follows supply exploit as restart remains unclear — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/evm-network-halts-block-production-after-supply-exploit-as-ton-connection-remains-dark/"},{"credibility":1,"name":"Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"credibility":2,"name":"Cosmos Labs Urges EVM Chains To Halt As Shared Bug Drains Three Networks — The Defiant","type":"news_article","url":"https://thedefiant.io/news/blockchains/cosmos-labs-urges-evm-chains-halt-shared-bug-drains-three-networks"},{"credibility":2,"name":"TON Application Chain and Polygon team up to launch new TON L2 — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/ton-polygon-launch-new-ethereum-l2-tac"},{"credibility":2,"name":"TAC raises $6.5 million to provide TON and Telegram users in-app access to EVM applications — The Block","type":"news_article","url":"https://www.theblock.co/post/325410/tac-seed-round-ton-telegram-evm"},{"credibility":2,"name":"TAC mainnet launch aims to bridge Ethereum DeFi to TON — Blockworks","type":"news_article","url":"https://blockworks.com/news/tac-mainnet-launch-ethereum-ton"},{"credibility":2,"name":"TAC climbs off record low after exploit forces chain halt — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/tac-climbs-after-exploit-forces-chain-halt/"},{"credibility":2,"name":"TAC Sidechain Halts After Supply Exploit As TON Mainnet Remains Separate — Bitcoinist","type":"news_article","url":"https://bitcoinist.com/tac-sidechain-halts-after-supply-exploit-as-ton-mainnet-remains-separate/"},{"credibility":2,"name":"Cosmos EVM Vulnerability Exploited: Critical Flaw Leads to Multi-Chain Blockchain Attacks — Rescana","type":"research","url":"https://www.rescana.com/post/cosmos-evm-vulnerability-exploited-critical-flaw-leads-to-multi-chain-blockchain-attacks-and-5-7m-losses"},{"credibility":2,"name":"Blockchain Hack Drains 28.6% of TAC Supply From Staking Pool — Coindoo","type":"news_article","url":"https://coindoo.com/blockchain-hack-drains-28-6-of-tac-supply-from-staking-pool/"},{"credibility":3,"name":"TAC official X announcement on BNB Chain migration","type":"social_media","url":"https://x.com/TacBuild/status/2095242472230457749"},{"credibility":2,"name":"Cosmos EVM vulnerability: Six Chains Affected — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/cosmos-evm-vulnerability-chain-halt/"},{"credibility":2,"name":"EVM on TON: TAC Founder Marco Monaco and the Future of Interoperability — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/evm-on-ton-tac-founder-marco-monaco-and-the-future-of-interoperability/"}],"summary":"TAC Network (TON Application Chain) is a Cosmos-based EVM Layer 1 blockchain designed to bridge Ethereum-compatible decentralized applications to the TON and Telegram ecosystem. On August 22, 2026, the network suffered a critical exploit via a shared Cosmos EVM vesting-account vulnerability, resulting in the drainage of approximately 2.99 billion TAC tokens (28.6% of total supply) from the bonded staking pool. The TAC Foundation responded by halting the chain and subsequently migrating the entire BEP20 TAC token supply on BNB Chain to a new contract that deliberately excluded attacker-linked addresses — a supply rewrite that raised token integrity questions for existing holders.","timeline":[{"date":"2024-07-09","event":"TAC announced integration with Polygon CDK and Agglayer to build a TON-connected EVM Layer 1.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/ton-polygon-launch-new-ethereum-l2-tac"},{"date":"2025-01-01","event":"TAC raised $6.5 million in a seed round led by Hack VC and Symbolic Capital.","source":"The Block","source_url":"https://www.theblock.co/post/325410/tac-seed-round-ton-telegram-evm"},{"date":"2026-04-25","event":"A researcher reported the Cosmos EVM vesting-account vulnerability to Cosmos Labs via its bug bounty program. Cosmos Labs initially assessed it posed no risk.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"date":"2026-08-13","event":"Cosmos Labs confirmed internally that all Cosmos EVM chains — regardless of decimal configuration — were vulnerable to the vesting-account bug.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html"},{"date":"2026-08-19","event":"Cosmos Labs released patched versions 0.6.2 and 0.7.2 via a silent patch process, without vulnerability-specific public disclosure.","source":"crypto.news","source_url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"date":"2026-08-20","event":"MANTRA became the first known victim of the Cosmos EVM exploit, losing approximately 720.9 million tokens (~$3.6 million nominal) within approximately 12 hours of the patched release.","source":"crypto.news","source_url":"https://crypto.news/cosmos-evm-vulnerability-drains-mantra-tac-and-kiichain-in-cross-chain-attacks/"},{"date":"2026-08-22","event":"An attacker drained 2,985,651,403.40 TAC tokens (28.6% of total supply) from TAC's bonded staking pool using the Cosmos EVM vesting-account vulnerability. The attacker bridged stolen tokens to BNB Chain within 95 seconds.","source":"Startup Fortune","source_url":"https://startupfortune.com/tac-is-rewriting-its-own-token-supply-to-strand-the-hacker-who-drained-it/"},{"date":"2026-08-22","event":"TAC halted validator block production at block 24,671,475 at 23:58:11 UTC. KiiChain was also attacked on the same day, losing approximately 148 million KII tokens.","source":"CryptoSlate","source_url":"https://cryptoslate.com/evm-network-halts-block-production-after-supply-exploit-as-ton-connection-remains-dark/"},{"date":"2026-08-25","event":"Cosmos Labs publicly urged all Cosmos EVM chains to halt operations due to the shared vulnerability. Up to six chains were ultimately affected with approximately $5.72 million in total stolen assets.","source":"Yahoo Finance / BeInCrypto","source_url":"https://finance.yahoo.com/markets/crypto/articles/cosmos-labs-confirms-cosmos-evm-043443408.html"},{"date":"2026-09-01","event":"TAC Foundation published a postmortem confirming the 2,985,651,403.40 TAC drain and announcing a three-part recovery plan, including a 1,258,228,061.40 TAC treasury bailout.","source":"CryptoSlate","source_url":"https://cryptoslate.com/tac-remains-frozen-for-over-10-days-after-a-massive-exploit-forces-a-1-26-billion-token-bailout/"},{"date":"2026-09-02","event":"TAC Foundation took a snapshot of BNB Chain wallets at block 119,573,620 (17:16 UTC) as part of the BEP20 token migration plan, deliberately excluding attacker-linked addresses from the new contract.","source":"Startup Fortune","source_url":"https://startupfortune.com/tac-is-rewriting-its-own-token-supply-to-strand-the-hacker-who-drained-it/"},{"date":"2026-09-04","event":"TAC mainnet resumed block production from block 24,671,476. Trading of the new BEP20 TAC contract (0xb305E6954e4e0Cd021c06Ec355681abc8A00dbD7) went live on Binance Alpha at 08:00 UTC.","source":"Startup Fortune","source_url":"https://startupfortune.com/tac-is-rewriting-its-own-token-supply-to-strand-the-hacker-who-drained-it/"}]},"v":1}