Talis Protocol has frozen new listings and auctions on its Injective NFT marketplace after an exploit removed roughly 5,700 NFTs that users had already placed in escrow. The assets were held by marketplace smart contracts while listed for sale or auction, so the exposure was in the platform’s handling of inventory, not simply a theft from individual wallets.
The attack involved Talis’s marketplace and auction contracts, but the precise vulnerability has not been detailed. Talis responded by stopping the functions most directly connected to those escrow flows, and paused operations on its other supported chains as a precaution. That limits new assets entering the affected processes while the contracts are reviewed.
The attacker reportedly sold most of the NFTs at fire-sale prices, extracting about 445 Injective tokens, worth roughly $3,100 at the time. That cash total understates the user impact: owners had placed these assets in escrow and they were dumped without consent.
For now, users know the marketplace stopped new listings and auctions, but the recovery outcome and the precise failure path remain unresolved.