Web3 Security Breaches Hit Solana Seeker, Injective NFT Marketplace Talis

Security incidents have struck Solana's mobile ecosystem and an NFT marketplace on the Injective network.

Cointelegraph reported on November 1 that a malicious application was listed on the Solana Seeker decentralized application, or dApp, store before being removed. The app asked users for their wallet recovery phrase.

The app, listed under the name "SKR Claim," prompted users to enter their seed phrase. A seed phrase is the key information used to restore access to a crypto wallet, and exposure can lead to asset theft.

Seeker said the malicious app was visible in the store for about an hour after its developer portal was compromised. The app has since been removed, and the exploited vulnerability has been fixed. Seeker did not disclose whether any users were affected or the scale of any losses.

On the Injective network, NFT marketplace Talis lost about 5,700 NFTs in an attack that exploited a smart-contract vulnerability.

In a post on X on October 31, Talis said the attacker used flaws in its marketplace and auction smart contracts to take NFTs listed for sale or auction without authorization. The attacker then sold the stolen NFTs into existing buy orders.

After the incident, Talis halted new NFT listings and auctions on the Injective network and returned more than 26,000 NFTs held in its smart contracts to their original owners. It also temporarily suspended new listings and auctions on other networks to prevent further losses.

Talis is reviewing an updated smart contract ahead of deployment. It is also preparing measures to return the stolen NFTs to their original owners and compensate buyers for losses, and plans to publish a list of the affected NFTs.