Talis Protocol Exploit: About 5,700 NFTs Stolen and Sold as Marketplace Freezes Listings
A marketplace exploit, disclosed on Halloween
The Cosmos ecosystem NFT marketplace Talis Protocol disclosed on October 31 that attackers exploited vulnerabilities in its marketplace and auction contracts on Injective, withdrawing about 5,700 NFTs held in custody and selling them into public collection offers. The disclosure, reported via ChainCatcher and carried by Binance Square and KuCoin News on November 1, is one of the sharpest NFT-security incidents of the year — not because of a dollar figure, which has not been published, but because of what was taken: custody-held NFTs, the assets users trusted the marketplace contracts to hold. Talis has paused new listings and auctions on Injective, returned more than 26,000 NFTs held in its contracts to their owners, and as a precaution paused new listings and auctions on other chains too, advising users not to buy, list or bid on Talis until the fix is confirmed secure. Users may still cancel unfulfilled offers.
What Talis is doing about it
Talis says a patched contract is ready and undergoing review before deployment, with a timeline to be announced later. The team says it has recorded every affected NFT, its holder before the theft, and each sale price, and is developing a plan to return the NFTs to their original owners and compensate the bidders, with an official list of affected assets to be published. Its warning is blunt and worth repeating: do not purchase these NFTs during this period, and note that Talis will never ask users to connect their wallets via direct messages to claim anything — the classic follow-on scam after any exploit. A full post-incident report is promised. For context on the project's scale: RootData lists Talis Protocol as founded in 2021, with a $2.35 million private funding round in November 2021. This was not a giant marketplace, but the pattern is the one that matters — a contract-level flaw, custody-held assets drained into public offers, and a recovery that depends on tracing every sale.
The wider NFT market this exploit landed in
The exploit landed in a thin market. A crypto.news wrap of CryptoSlam's seven-day board put global NFT sales at about $42.13 million, down about 35.37% on the week, with Ethereum near $13.17 million, Polygon near $9.40 million and Bitcoin near $6.27 million, and Courtyard leading collections near $8.58 million. That weakness is the backdrop, not the story: thin markets do not cause exploits, but they do make recovery harder, because stolen NFTs sold into quiet collection offers are harder to unwind and easier to flip. The structural shift also continues elsewhere: Blur will shut down its marketplace frontend on November 12, 2026, with its Blend lending protocol stopping new loans the same day, while its smart contracts keep running on Ethereum — a reminder that in NFTs, the website and the protocol are different things, and the protocol outlives the frontend. For Web3 gaming, the lesson travels directly: games increasingly run their own markets or rely on ecosystem marketplaces such as Ronin Market and Immutable's orderbook, where item trading sits next to gameplay — and every one of those venues is a custody contract with the same class of risk Talis just demonstrated.
What NFT holders and gamers should do now
First, if you hold anything on Talis, do not buy, list or bid there until the fix is confirmed secure — cancel unfulfilled offers if you need to, and wait for the official affected-assets list. Second, treat any direct message offering to "claim" or "recover" your NFTs as a scam, full stop. Third, for gaming assets generally, prefer venues where you understand who holds the asset: a game-run marketplace or a well-audited ecosystem orderbook is not risk-free, but a marketplace contract holding thousands of custody NFTs is exactly the honeypot attackers probe. The Talis recovery — 26,000-plus NFTs already returned, a patched contract under review — shows the team moving fast. Whether the 5,700 sold NFTs come back to their owners will be the real test, and it will be measured in the post-incident report, not in today's reassurances.
FAQ
What happened at Talis Protocol? Attackers exploited its marketplace and auction contracts on Injective; about 5,700 custody-held NFTs were withdrawn and sold into public collection offers. The incident was disclosed October 31.
What has Talis done so far? Paused listings and auctions on Injective and, as a precaution, other chains; returned over 26,000 NFTs from its contracts to owners; a patched contract is under review.
Can affected owners get their NFTs back? Talis says it recorded every affected NFT, its prior holder and each sale price, and is developing a return-and-compensation plan; an official list is coming.
What should users NOT do? Do not buy, list or bid on Talis until the fix is confirmed secure, do not buy the affected NFTs, and never connect a wallet via a direct message "claim".
How is the wider NFT market doing? Thin: about $42.13 million in weekly global sales, down about 35.37%, with Ethereum leading chains at about $13.17 million.
Read more on Zimbuck: https://zimbuck.com/pages/zimbucknews and join the discussion at https://zimbuck.com/groups/zimbuckmarketnews. Related reading on the site: the NFTs & Gaming guide in the NFTs & Gaming category.
This article is market news and general information only, not financial advice.
