The TAC network remains halted after a critical exploit drained nearly 30% of its token supply. A $1.26 billion TAC treasury bailout is planned, but over 1.6 billion attacker-held tokens on BNB Chain remain in limbo.
Ten days after a devastating exploit froze the TAC blockchain, the network's future hangs on a high-stakes rescue plan-and a massive pile of attacker-controlled tokens still outside its reach. TAC's validators have yet to restart block production, leaving users and stakers locked out while the protocol scrambles to patch a critical vulnerability and restore trust.
Exploit Mechanics
The attack, which struck at block 24,671,475 on August 22, targeted TAC's bonded staking pool. According to TAC's postmortem, a flaw in the Cosmos EVM implementation allowed an attacker to delegate more tokens than were actually spendable, triggering an unchecked subtraction that wrapped balances to near-maximum values. This overflow enabled the attacker to drain 2,985,651,403.40 TAC-28.6% of the total supply-without altering the overall token count, but leaving the staking pool empty and delegator records unbacked.
Cosmos Labs had previously identified the bug as critical, with vulnerable versions of Cosmos EVM below 0.6.2 and select 0.7.x releases. The issue was reported to the Cosmos EVM bounty program in April, patched on the main branch in May, and backported to releases just days before the TAC exploit. TAC claims it submitted related defect analyses in July but received no acknowledgment from maintainers.
Token Fallout and Recovery Plan
On-chain data shows the attacker moved 1,208,329,197 TAC to BNB Chain, selling for 950,293 USDT, and offloaded another 49.9 million TAC on TON for 55,481 USDT. The total realized proceeds reached just over $1 million, but the exploit left 1,662,322,353 TAC sitting in BNB Chain addresses linked to the incident-tokens that remain outside TAC's direct control.
TAC's proposed recovery involves a targeted state edit at the halt block, removing 65.1 million incident-linked TAC frozen on the network and fully replacing 1,258,228,061.40 TAC from the TAC Foundation's treasury to cover the sold tokens. This approach avoids a full chain rollback, instead correcting balances while preserving 7,772 legitimate transactions from 218 unrelated addresses. The plan does not address the fate of the 1.66 billion TAC still on BNB Chain, leaving a major supply overhang unresolved.
Network Status and Validator Hurdles
As of September 2, TAC's mainnet remains halted, with RPC endpoints showing no new blocks since the exploit. Validators must adopt the patched binary, resume block production, and execute the state edit before the network can restart. Bridging and redemption functions are still disabled, and the project has not announced a timeline for resolving the status of attacker-held tokens on BNB Chain.
The scale of the incident dwarfs many recent Layer 1 exploits, both in percentage of supply and operational disruption. For context, TAC's halted status echoes the kind of network-wide freezes seen in other critical protocol incidents, such as the reported earlier Bitcoin Core feature freeze, though the underlying causes and stakes differ sharply.
Token Supply and Market Impact
At the time of the exploit, TAC's total supply stood at approximately 10.4 billion tokens, with nearly 3 billion drained from the bonded staking pool. The foundation's commitment to replace 1.26 billion TAC from treasury reserves covers only the tokens sold by the attacker, not the full amount siphoned or still held on BNB Chain. The unresolved status of over 1.6 billion TAC outside the network raises ongoing dilution and market risk for holders, as these tokens could re-enter circulation if not effectively frozen or recovered.
TAC's situation exposes the fragility of cross-chain token flows and the limits of protocol-level recovery when attacker assets move beyond the original network. The foundation's willingness to absorb a $1.26 billion TAC shortfall from its reserves may stabilize delegator balances, but it does not erase the risk posed by the massive supply overhang on BNB Chain. Until validators coordinate to restart the network and a credible plan emerges for the stranded tokens, TAC's credibility and user confidence remain on the line. This episode is a stark reminder that even with rapid patching and treasury intervention, the consequences of a critical exploit can linger for weeks or longer-especially when cross-chain liquidity and incomplete governance leave the door open for further disruption.
Cross-chain exploits like TAC's highlight a core vulnerability in blockchain infrastructure: once tokens are bridged or sold on external networks, protocol teams lose direct control over their fate. Even with treasury reserves and state edits, projects face hard limits on what can be clawed back without broad validator and exchange cooperation. This dynamic complicates recovery, increases dilution risk, and can undermine user trust in staking and delegation models-especially when a large share of supply remains in attacker hands outside the original chain's reach.
