TAC says Cosmos EVM flaws enabled a $1 million staking-pool exploit

The project stresses that the transaction was a drain, not a mint: total supply did not change. The attacker bridged the tokens to BNB Chain within 95 seconds, sold 1.208 billion TAC there for about 950,293 USDT, and sold another 49.9 million TAC on TON for about 55,481 USDT.

TAC estimates total realized stablecoins at roughly $1.006 million. It says only TAC was affected and other assets on the network remain intact. Staked balances are currently unbacked, while block production, transfers, staking and unstaking remain unavailable during recovery preparation.

Three defects combined across two ledgers

According to the project, a shared Cosmos EVM module mishandled balances for vesting accounts, allowed an integer underflow and failed to protect a protocol-controlled account on the relevant transfer path. Together, those defects let an exploit contract overflow the staking pool's recorded balance and move its real tokens.

The postmortem says the root cause has been reproduced against the live binary and fixed in a patched build. TAC plans a coordinated upgrade and state edit to restore staking balances, with treasury reserves covering the portion sold into public markets. Those are announced recovery steps, not yet a completed restart.

Users should follow official recovery updates only. TAC says it will not ask holders to connect a wallet, submit a claim or send funds, and warns that unofficial recovery links are fraudulent. The important verification points are validator adoption of the patch, resumed blocks, restored staking balances and safe bridge reactivation.

The report is TAC's account and includes unresolved questions about upstream communication and responsibility. Independent code review, validator confirmation and onchain reconciliation would strengthen confidence in its causal explanation. Attribution should remain explicit while those checks continue.