What happened
On January 8, 2026, Truebit was exploited through an integer-overflow pricing bug. Reports estimate approximately $26.6M extracted; the campaign uses a conservative $26.5M canonical estimate.
Technical root cause
Truebit’s getPurchasePrice() path relied on arithmetic vulnerable to integer overflow in legacy Solidity below 0.8.0, causing the required ETH price to evaluate to zero for a very large input.
How it happened
The attacker supplied an extremely large mint amount that made getPurchasePrice() return zero, called buyTRU() to mint TRU without paying ETH, and repeatedly called sellTRU() to drain ETH.
Protocol details
Classification
Arithmetic Error
Protocol Type
Exploit/Other
Implementation language
Solidity
Protocol links
Website
@Truebitprotocol
Attacker Address
0x6C8EC8f14bE7C01672d31CFa5f2CEfeAB2562b50
Exploit Transaction
0xcd4755645595094a8a…29c47fb014
Evidence
Proof of concept
1 available- Code Truebit OverFlow
Sources
- report @CertiKAlert incident report x.com
- report @Truebitprotocol incident report x.com
- report @PeckShieldAlert incident report x.com
- transaction Truebit exploit transaction etherscan.io
- analysis Website reference certik.com
- analysis DeFiLlama defillama.com
- analysis CertiK: Truebit Incident Analysis certik.com
- analysis Halborn: Explained - Truebit Hack halborn.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
