Truebit Protocol Exploit Drains 8,535 ETH

The Truebit Protocol, an early Ethereum-based system for verifying complex off-chain computations, suffered a major security exploit on January 8, 2026, resulting in the theft of approximately 8,535 ether valued at around 26 million dollars from its reserves.

Blockchain security firms, including PeckShield and CertiK, identified the breach as stemming from a vulnerability in an outdated smart contract deployed about five years earlier. The flaw was in the contract's pricing logic, specifically the getPurchasePrice function, which returned a zero price for unusually large token minting requests. This allowed the attacker to mint vast quantities of Truebit's native TRU tokens at no cost and immediately sell them back through the protocol's bonding curve mechanism. The repeated buy-sell cycles drained the contract's ether holdings in a series of rapid transactions. On-chain analysis showed the stolen funds were consolidated into at least two addresses, with portions routed through Tornado Cash, a privacy tool used to obscure transaction trails.

Truebit confirmed the incident in a statement on X, the social media platform formerly known as Twitter. "Today, we became aware of a...