Talis confirms an Injective marketplace exploit involving about 5,700 escrowed NFTs
Talis says an attacker exploited its marketplace and auction contracts on Injective on October 31. About 5,700 escrowed NFTs were taken and sold into open collection offers. This is an NFT count, not a victim count or dollar loss; a verified fix and final scope remain unestablished in the original post read.
- Disclosed
- Oct 31, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- NFTs escrowed in Talis marketplace or auction contracts on Injective; precise affected collections and holders are not listed
- crypto
- In the wild
- Yes
- Talis directly confirms exploitation and the taking and sale of escrowed NFTs.
What happened
L4 reflects a vendor-confirmed exploit affecting escrowed assets. The project identifies its marketplace and auction contracts, rather than an unexplained wallet transfer. The read first post does not give a dollar valuation, unique victim count, technical root cause or verified recovery procedure. The checklist provides general precautions, not a vendor-approved contract exit or compensation claim route.
Crime-scene timeline
Oct 31, 2026
Talis confirms exploitation of marketplace and auction contracts on Injective
The project reports about 5,700 escrowed NFTs taken and sold into collection offers.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Talis original incident disclosurePrimaryComplete first post of the thread confirms the Injective exploit and approximate NFT count; subsequent thread posts were not independently readable.
- Official public embed of Talis's disclosurePrimary