TAC Announcement Channel

The swap announced yesterday is complete: new $TAC has been sent to eligible wallets on BNB Chain, you can check your wallet now. If the token does not show up, add it manually: 0xb305E6954e4e0Cd021c06Ec355681abc8A00dbD7.

Smart contract addresses are handled separately, through the Google Form until October 8: https://forms.gle/vqD5AHX7xFnvuwFx7

If you have any questions, join our Telegram community: @tacbuild

Tomorrow, September 9, at 10:00 UTC we start the $TAC contract swap on BNB Chain.

Every address that held the old BEP20 $TAC at block 119,573,620 gets the new token 1:1. That is 465.4M new $TAC to around 3,700 addresses, sent in several batches over the following hours. This covers regular wallets, EIP-7702 wallets, Safe multisigs, LP positions in the main TAC pools on PancakeSwap and Uniswap, and bridge transfers that were in flight at the halt.

You do not need to do anything. The new tokens come from our distribution wallet 0xaF7834D0cBf8542d169b380f768d889c3Fb06d86. New $TAC contract: 0xb305E6954e4e0Cd021c06Ec355681abc8A00dbD7. If it does not show up in your wallet, add it manually with this address.

There is no claim site. We will never ask you to connect your wallet anywhere. Be careful with anyone who does.

LP amounts reflect the $TAC in your position at the snapshot. The whole swap is visible on-chain from the wallet above.

If your address is a smart contract (vesting, protocol contract or any other) and it is not in this batch, get in touch and we will process the swap for it. Requests are open until October 8: https://forms.gle/vqD5AHX7xFnvuwFx7

Update on exchanges. $TAC deposits and withdrawals have also resumed on Kucoin and Bitget.

TAC is back and operating normally.

Mainnet has been producing blocks since September 2, resumed at height 24,671,476 on the patched release.

> Staking pool restored in full: 2,985,651,403.40 $TAC. You can transfer, stake and unstake as normal again.
> TAC<>TON bridge is fully operational. All transfers that got stuck during the halt have been processed.
> TAC<>BNB Chain bridging via LayerZero has been re-enabled for the new $TAC contract. Liquidity for the new pool on BNB Chain is live and trading of the new $TAC has started. We are currently working on the bridge UI listing.

Exchanges: $TAC deposits and withdrawals have resumed on Binance Alpha, Bybit, Kraken and MEXC, with other venues following today.

Bridge transfers to BNB Chain that got stuck during the halt will be credited in the migration.

Later today we will publish the list of addresses receiving the new $TAC on BNB Chain, with the amounts.

https://x.com/TacBuild/status/2095796515650609395

$TAC on BNB Chain is migrating to a new contract. The snapshot has already been taken.

We are replacing the BEP20 $TAC on BNB Chain, where 1,662,322,353 $TAC is linked to the August 22 exploit. The migration cuts the attacker off from the stolen supply he still controls.

New $TAC contract on BNB Chain: 0xb305E6954e4e0Cd021c06Ec355681abc8A00dbD7
Any other address is fake.

Snapshot block: 119,573,620 (September 2, 17:16 UTC). It was taken before this announcement so the attacker could not use his supply to interfere with the distribution. Snapshot only records who held $TAC at that block.

What happens now:

> Held $TAC in your own wallet or in an LP position at the snapshot block: you receive the new token automatically. Attacker-linked addresses are excluded.
> Held on Binance Alpha: the token swap and trading of the new token go live there on Friday, September 4, 08:00 UTC.
> Proposed airdrop list will be published shortly, with three business days to dispute it.
> New PancakeSwap pool and TAC<>BNB Chain bridging will be back by Friday.
> There is no claim site. Never connect your wallet anywhere to "claim".

Do not buy or trade the old token: purchases via trading/OTC/transfers after the snapshot block will not be credited. $TAC on Ethereum and TON is not part of this migration.

https://x.com/TacBuild/status/2095242472230457749

⚠️ $TAC on BNB Chain: STOP all activity.

Do not trade, swap or transfer it, on any exchange or pool, until further notice.

Post-Mortem: The Cosmos EVM Exploit on TAC

Between August 20 and August 25, attackers exploited a vulnerability in the Cosmos EVM module and extracted funds from multiple blockchains. TAC was one of six networks affected.

On August 22 a single transaction moved our entire staking bonded pool, 2,985,651,403.40 TAC, to an attacker-controlled account. Together with TAC validators we halted the network the same evening. This was a drain, not a mint: total supply did not change and only $TAC was affected.

Today we are publishing the official post-mortem, detailing what happened, how it happened, where the funds went, how we are recovering, and what it means for stakers and holders.

The approved recovery plan restores staking balances in full. No action is required from delegators.

If you hold $TAC on BNB Chain, do not trade it. How those holdings are treated in the recovery will be announced separately.

Read the full post-mortem: https://tac.build/blog/tac-mainnet-security-incident

In coordination with the Cosmos Labs team, we are holding off on publishing our post-mortem and recovery plan.

Since the vulnerability involves the shared Cosmos EVM module, Cosmos Labs asked us to give them a bit more time to ensure all affected Cosmos-based networks are patched safely.

We're fully aligned with prioritizing the security of the wider ecosystem.

Both documents will be published in full very soon.

https://x.com/TacBuild/status/2092553924477591937

On August 22 an attacker exploited a vulnerability in the Cosmos EVM precompile layer and drained a single account on TAC. We halted the chain at block 24,671,475 to stop it. The defect is not in TAC-specific code. It sits in the shared Cosmos EVM module, and several other chains running that module were hit by the same class of attack within a day.

This was a drain, not a mint. No tokens were created and total supply is unchanged: 2,985,651,403 TAC was moved from one account to another. Only $TAC was affected, and all other assets on TAC are intact.

We are finalising the technical post-mortem and the relaunch plan, and expect to publish both tomorrow. The plan is built to normalize $TAC balances and include all the necessary Cosmos fixes to safely restore the network.

We are working with SEAL 911 and with exchanges on the funds that moved.

https://x.com/TacBuild/status/2091873937655574938

The TAC team is currently investigating an exploited vulnerability on the Cosmos-based EVM side of TAC, affecting only $TAC supply.

We work with TAC validators, and a few hours ago we immediately implemented a temporary chain halt.

We will keep you posted on the next findings and next steps for chain resume. Please only follow official channels for updates.

https://x.com/tacbuild/status/2091312709438444021?s=46&t=2ESVRNuP76O-S3RJiIPmbw

Over the past 24 hours TAC experienced a sharp price decline. We know many of you are holding losses today. We take that seriously, and you deserve a direct explanation.

1. No exploit. TAC was not hacked in any form. The protocol operates exactly as designed. All on-chain assets are safe.

2. No insider selling. Neither the team nor early backers contributed to the selling pressure. Team and investor tokens remain fully locked and vested. Unlocks have not begun and are technically impossible at this stage.

3. What happened. We completed an internal review of trading activity, both on-chain and using data available to us from centralized venues. There was no minting of tokens and no malicious activity. The decline was a liquidation cascade triggered initially by a large perpetual futures sell order exceeding the relatively thin liquidity on the market. That in turn resulted in a cascade of liquidations on the perp market as well as sell pressure on spot venues. We continue to monitor trading activity closely.

4. What’s next. The team is fully committed to building. We are finalizing a set of measures focused on strengthening market structure, deepening liquidity, and rebuilding confidence with our community, partners, and investors. We will share the concrete details later this month.

Price moved. Fundamentals did not. We build for the long term.

❗️ Important notice for TAC node operators

The TAC mainnet upgrade v1.6.0 is scheduled for June 30, 2026, ~12:00 UTC (block ~21,776,800).

If you run a TAC node, action is required before the upgrade height:

• Upgrade to the v1.6.0 binary
• Set evm-chain-id = 239 in app.toml

We also recommend running Cosmovisor to apply the upgrade automatically at the scheduled height, no manual intervention needed at block time.

Full upgrade details
Cosmovisor setup guide

As mentioned in reopening announcement, here is the full context behind the deliberate decision that resulted in 316 duplicate transactions reaching a few hundred users on TON.

When the bridge was drained during the May 11 incident, a number of legitimate cross-chain transactions initiated by users were left in limbo: processed on the TAC side, but never settled on TON because the TON Adapter no longer held the funds to complete them.

Ahead of the relaunch, we faced a clear choice on how to handle these pending transactions.

The first option was to hard-fork TAC: coordinating with validators and partners, re-issuing tokens to mirror a snapshot of the previous state, and a number of operations that break the immutability of the TAC blockchain. Immutability is a core property of any serious chain, and we will not compromise it to patch an operational issue, however convenient that shortcut would have been.

The second option was to let the TON Adapter process these pending transactions through its normal flow once the bridge was live. This preserved chain soundness and immutability. The trade-off: 316 transactions reprocessed on TON, delivering approximately $80,000 to users who were not meant to receive them.

We chose immutability.

If you received an unexpected transaction in any of these assets: TAC, USDT, BLUM, tsTON, Re7 USDTv2, Re7 cbBTCv2, Re7 WETHv2, mRe7YIELD, cbBTC, syUSDT - kindly return the funds back to the TAC team multisig on TON: UQAkTfPo4zo72Zyr5dk1QrWvCWlgA0gRd3njyg5hqmwdrQrI

We appreciate your cooperation.

We're happy to share that cross-chain transactions between TON and TAC are now available again.

The patched sequencer software has been independently reviewed by our auditor and TON ecosystem partners and we can resume operations with complete confidence. TAC CCL is now safer than ever.

All missing funds in USDT, BLUM, and tsTON have been restored. Users can use TAC-powered products (DeFi Wallet vaults, Acid ID staking feature, and others) as before. Affected users expecting transactions on TON in BLUM or USDT will receive their funds automatically - no action is required from their side.

❗️Important Notice: As part of the relaunch, a necessary step resulted in some users receiving more tokens than expected.

More details to follow in a post later today.

Thank you for your support, patience and trust.

For any questions, please reach us in our Telegram community: @TACbuild

Update on the TAC CCL re-enablement.

The final patches at the sequencer level are being independently reviewed by our auditor and TON ecosystem partners. This work is in its final stage.

Restoration of the missing funds in USDT, BLUM, and tsTON is underway. Yesterday we completed three steps:

1) The assets recovered from the attacker were consolidated into USDT
2) USDT was moved to TON
3) BLUM held on the TAC side was burned as planned.

At this point, we need to settle the outstanding gap in BLUM and USDT, which we are currently working on. We expect the TAC CCL to re-open very soon. The full announcement will follow once everything is in place.

In the meantime, please rely only on this account and our official Telegram for updates. Any unsolicited "support" or "recovery" DMs should be treated as scams.

Thank you for your support, patience, and trust throughout this process.

For any questions, please reach us in our Telegram community: @TACbuild

On May, 11th a security incident affected TON-TAC asset bridge. Over the past few days, TAC team has been engaged in post incident efforts, which, four days after, have resulted in the return of approximately 80% of the affected assets.

Today, we are publishing the official post-mortem report detailing everything that happened behind the scenes of the incident.

The root reason traced to a single missing validation in our sequencer software: the responsible party deployed a counterfeit jetton wallet on TON, and the sequencer accepted the counterfeit tokens because it did not verify the sender wallet's code hash. The total loss was approximately $2.86M across USDT, BLUM, and tsTON.

Following a public appeal and subsequent recovery efforts, the assets under the responsible party's control were successfully secured, with approximately 90% returned to TAC-controlled multisigs on May 14th and the remaining 10% retained by the responsible party.

The bridge remains paused while the patched sequencer software is independently reviewed by our auditor and TON partners. We understand the urgency - affected users and integrated projects want the bridge back, and so do we. At the same time, security comes before speed.

Cross-chain operations will only resume once the fixed software has been fully verified and the imbalance has been closed using the recovered assets and the TAC Foundation's token reserve. Both steps take time due to coordination with multiple entities, and we are unable to provide precise timelines at this stage due to external dependencies. When operations resume, the change will be transparent to users with no action required from their side.

The remaining gap will be covered by the TAC Foundation treasury, ensuring zero financial impact on users or the protocol. Official updates are only posted through this account and our Telegram; any unsolicited "recovery" or "support" DMs are scams.

Thank you to the TON community and the broader TON and EVM ecosystems for their support.

Read the full post-mortem: https://tac.build/blog/post-mortem-report-tac-bridge

Hello everyone!

We're happy to announce that ~90% of the funds from the May 12th security incident have been recovered.

The attacker decided to return the funds that were sitting across Ethereum, TON, TAC, BSC and Zcash, and retained the 10% as a bounty.

We are happy to confirm that the unbalance on the cross-chain layer will be completely fixed.

A detailed update and full post-mortem will follow in the coming days.

Big thanks to SEAL911 our security partners, the TON community and to every partner team that stood with us.

Multisigs under TAC control with received funds:

ETH/BSC/TAC → https://etherscan.io/address/0xa05CBfF7b395DeA456539Db279AbC6EE5a8150f9#tokentxns
TON → https://tonviewer.com/EQAkTfPo4zo72Zyr5dk1QrWvCWlgA0gRd3njyg5hqmwdrVcN
ZEC → https://blockchair.com/zcash/address/t1dXd2EUAe34BYEtNUtNfrBFQTTs8LhoTUH

Following the security incident, we identified an exploit on the TON side of the TAC crosschain layer that was carried out by an external attacker. The incident resulted in a loss of approximately $2.8M across USDT, BLUM, and tsTON.

The TAC token, TON and all ERC-20 tokens bridged from Ethereum are NOT affected.

The bridge remains paused while forensic analysis and remediation work are ongoing. A post-mortem with additional disclosure will be published in the next 48 hours.

We are actively working with law enforcement, SEAL 911, and our security partners to trace and block the stolen funds.

Our focus is on making users whole and fully restoring bridge liquidity through a legally structured sale of Foundation’s TAC token treasury reserves.

We will continue to share updates through our official channels. Thank you for your patience and trust.

We are currently investigating a security incident affecting the TAC bridge with TON.

The bridge has been paused as soon as we received reports from our security partners.

The issue appears isolated to native TON Jettons bridged from TON (excluding $TON). $TON and every other Ethereum native asset are not affected.

TON cross-chain transactions remain paused while the investigation is ongoing.

Protecting our users is our top priority. Should any users be affected as a result of this incident, we are committed to doing everything we can to make them whole.

We will be sharing regular updates through our official channels.

gTAC 🫰

Been a while since the last announcement, we have been building in the background.

TAC is advancing DeFi on TON by bringing blue-chip assets and institutional-grade yield directly into Telegram.

We recently announced the launch of cbBTC (Coinbase Wrapped BTC) on TON, enabling Bitcoin to be used natively on Telegram using TON-native wallets.

https://x.com/TacBuild/status/2025962907713097857

Fully backed 1:1 by BTC held in custody by Coinbase and supported by transparent Proof of Reserves, cbBTC combines Bitcoin’s security with EVM-native DeFi functionality. Through TAC’s EVM compatibility layer, this liquidity is now accessible on TON.

Building on this foundation, we've also introduced high-yield vaults for BTC, USDT, and ETH in partnership with Morpho, Re7 Labs, and TON Wallet. These vaults leverage Morpho’s battle-tested smart contracts, curated strategies from Re7 Labs, and seamless wallet integration inside Telegram.

https://x.com/TacBuild/status/2026977895873499440?s=20

TAC serves as the interoperability layer that enables EVM bytecode to run on TON, allowing established EVM-based DeFi protocols to operate within the Telegram ecosystem. For users, the experience remains simple: access blue-chip assets and deploy them into your favorite yield strategies directly from Telegram.

By combining Telegram’s distribution, TON’s performance, and the maturity of the EVM ecosystem, TAC is bringing DeFi to Telegram DMs.

TAC-enabled DeFi on Telegram will only accelerate from here. 🫰

Know more about the launch:

https://t.me/tonwallet_news_en/115