{
  "id": "talis-injective-nfts",
  "url": "https://ohshit.app/incidents/talis-injective-nfts/",
  "title": "Talis confirms an Injective marketplace exploit involving about 5,700 escrowed NFTs",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-31",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Talis",
    "Injective",
    "NFTs"
  ],
  "ecosystems": [
    "crypto"
  ],
  "summary": "Talis says an attacker exploited its marketplace and auction contracts on Injective on October 31. About 5,700 escrowed NFTs were taken and sold into open collection offers. This is an NFT count, not a victim count or dollar loss; a verified fix and final scope remain unestablished in the original post read.",
  "splash": "NFTs escrowed in Talis marketplace or auction contracts on Injective; precise affected collections and holders are not listed",
  "wipe": "Avoid new exposure to affected contracts; preserve NFT and transaction records and verify recovery instructions through official channels",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Avoid new exposure while verifying containment",
      "hint": "Check Talis's established official announcements before listing, bidding or purchasing through the affected Injective deployment. The initial original post does not identify a verified safe contract or a completed fix. Do not infer that all Injective applications or every chain used by Talis were compromised."
    },
    {
      "title": "Preserve NFT and transaction evidence",
      "hint": "Record collection contracts, token IDs, transaction hashes and the wallet that held each NFT before the incident. Verify any support or compensation instructions through established channels; do not disclose seed phrases or sign unsolicited recovery requests."
    }
  ],
  "sources": [
    {
      "name": "Talis original incident disclosure",
      "url": "https://x.com/ProtocolTalis/status/2116664033457680705",
      "says": "Complete first post of the thread confirms the Injective exploit and approximate NFT count; subsequent thread posts were not independently readable.",
      "primary": true
    },
    {
      "name": "Official public embed of Talis's disclosure",
      "url": "https://publish.twitter.com/oembed?url=https%3A%2F%2Fx.com%2FProtocolTalis%2Fstatus%2F2116664033457680705&omit_script=true",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Talis directly confirms exploitation and the taking and sale of escrowed NFTs.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 31, 2026",
      "title": "Talis confirms exploitation of marketplace and auction contracts on Injective",
      "body": "The project reports about 5,700 escrowed NFTs taken and sold into collection offers."
    }
  ],
  "body_markdown": "L4 reflects a vendor-confirmed exploit affecting escrowed assets. The project identifies its marketplace and auction contracts, rather than an unexplained wallet transfer. The read first post does not give a dollar valuation, unique victim count, technical root cause or verified recovery procedure. The checklist provides general precautions, not a vendor-approved contract exit or compensation claim route."
}