Truebit Hack

On January 8, 2026, Truebit Protocol suffered a $26.5 million exploit when an attacker exploited an integer overflow vulnerability in the getPurchasePrice() function, allowing them to mint hundreds of millions of TRU tokens for 0 ETH and sell them, draining 8,535 ETH from contract 0x764C64b2…302EF2, causing TRU token to drop 100% in value.

CertiK's analysis identified the root cause as a calculation overflow in the getPurchasePrice() function. The exploiter manipulated the function by inputting exceptionally large amount values , causing the numerator calculation to exceed 2^256 and overflow. Since the denominator (v6 = 25 * total_supply * total_supply) remained much larger than the overflow portion of the numerator, the division result rounded down to zero.

This allowed the attacker to repeatedly mint hundreds of millions of TRU tokens for 0 ETH cost, then immediately sell them on the market for ETH. PeckShield noted this same exploiter had previously attacked Sparkle protocol approximately 12 days earlier, obtaining 5 ETH and depositing it into Tornado Cash. Truebit immediately advised the public not to interact with the affected contract and contacted law enforcement.

Exploiter: https://etherscan.io/address/0x6C8EC8f1…562b50