Following the security incident, we identified an exploit on the TON side of the TAC crosschain layer that was carried out by an external attacker. The incident resulted in a loss of approximately $2.8M across USDT, BLUM, and tsTON. The TAC token, TON and all ERC-20 tokens bridged from Ethereum are NOT affected. The bridge remains paused while forensic analysis and remediation work are ongoing. A post-mortem with additional disclosure will be published in the next 48 hours. We are actively working with law enforcement, SEAL 911, and our security partners to trace and block the stolen funds. Our focus is on making users whole and fully restoring bridge liquidity through a legally structured sale of Foundation’s TAC token treasury reserves. We will continue to share updates through our official channels. Thank you for your patience and trust.

We, the TAC team, based on coordinated discussions with our security partners and law enforcement, formally assert that upon successful return of the funds to the TAC team multisig at 0xa05CBfF7b395DeA456539Db279AbC6EE5a8150f9 and EQAkTfPo4zo72Zyr5dk1QrWvCWlgA0gRd3njyg5hqmwdrVcN and t1dXd2EUAe34BYEtNUtNfrBFQTTs8LhoTUH: 1. Legal action will not be taken against the operator of the address(es) eth/bsc:0x46FB375EAc7a44C231b2b7aB762040ee74908CDc, zec:t1h6NcBAciYGdaVb4Ej1AELTx1D9UF9WUDr and ton:EQBPHhXyG_vbsAEnB6YccNhhaVc6I3ixOCc7vriaOzo4AFA8. The entity controlling the above address(es) carried out the incident affecting the TAC cross-chain layer in multiple transactions, resulting in the movement of approximately $2.8M in USDT, BLUM, and tsTON. Any further investigations or legal matters against the entity, in relation to this incident, will end. 2. We view this occurrence as a white-hat rescue, and as a result: eth:0x46FB375EAc7a44C231b2b7aB762040ee74908CDc and zec:t1h6NcBAciYGdaVb4Ej1AELTx1D9UF9WUDr will be rewarded with 10% of the recovered fund as a white-hat bounty from the TAC team, which translates to approximately 13 ETH + 300ZEC. 3. The remaining balance, will be directed to the TAC team multisigs mentioned above.

1/3 🚨 Transit Finance been hacked for ~$1.88M in ethereum:0x6b175474e89094c44da98b954eedeac495271d0f The stolen funds (~1.876M ethereum:0x6b175474e89094c44da98b954eedeac495271d0f + 1.37 $ETH) are still sitting untouched on this Ethereum address: 0x8a634DfA2609358849D7D65FFA270C8A57a8abA5 Related accounts linked to the exploit interacted with @CryptoRubic and @symbiosis_fi the day before the hack. More details 👇

Some sophisticated social engineering took place and some bad actors gained access to my centralised exchange account, they bought the top on TON and left Stay vigilant out there

UPDATE: @PeckShieldAlert reports that TransitFinance appears to have suffered a hack resulting in an estimated $1.88 million loss. According to the alert, the stolen funds are currently sitting in a wallet holding DAI stablecoins as investigators continue tracking the movement of funds.

🚨 TransitFinance Reportedly Hacked for ~$1.88M @PeckShieldAlert said @TransitFinance appears to have been hacked for around $1.88M. The stolen funds are reportedly sitting in a single address in DAI.

BREAKING: Transit Finance commits to full user compensation for $1.88 million exploit, linked to an old smart contract vulnerability on TRON involving $DAI.

We are currently investigating a security incident affecting the TAC bridge with TON. The bridge has been paused as soon as we received reports from our security partners. The issue appears isolated to native TON Jettons bridged from TON (excluding $TON). $TON and every other Ethereum native asset are not affected. TON cross-chain transactions remain paused while the investigation is ongoing. Protecting our users is our top priority. Should any users be affected as a result of this incident, we are committed to doing everything we can to make them whole. We will be sharing regular updates through our official channels.

Day 122 / 365 This one is honestly hard to look at. A seller on GetGems accepted an offer that looked like normal USDT for a rare NFT. No warning popped up. Nothing looked fake. Even the platform treated the token like it was real and converted it into TON automatically. A minute later, around $864K was gone. What makes this scary is that it was not some complicated exploit. The fake token looked almost identical to the real USDT inside the ecosystem, and most services could not properly tell the difference. So from the seller’s side, everything looked normal. That is the uncomfortable part about this story. People usually think crypto losses happen because someone clicked a bad link or connected to a fake website. This time the problem was deeper than that. The system itself failed to clearly separate a fake asset from a real one. And until proper verification exists at the protocol level, situations like this can keep happening again. Crypto moves fast, but stories like this are a reminder that some parts of the infrastructure are still far behind where they should be.