Truebit Protocol hack — January 2026

Truebit is a verification layer for off-chain computation whose TRU token could be minted and redeemed against an ether reserve through a bonding-curve contract deployed on Ethereum around 2021. On 8 January 2026 an attacker emptied that reserve.

The contract's getPurchasePrice function performed unchecked arithmetic in a legacy Solidity version predating automatic overflow protection. Passing a sufficiently large token quantity, which analysts give as an input of 240,442,509,453,545,333,947,284,131, caused an addition inside the price calculation to wrap around and return a purchase price of zero. The attacker minted TRU for no payment, immediately sold the tokens back to the same bonding curve for ether, and repeated the cycle several times inside a single transaction, removing 8,535.36 ETH.

Published dollar figures cluster between $26 million and $26.6 million. That spread reflects different ether marks on the day rather than any dispute over the quantity, which is fixed on-chain.

The vulnerable contract was roughly five years old, closed-source, and had not been kept under audit or monitoring; the published analyses are based on decompiled bytecode. TRU collapsed almost completely, from around $0.16 to a small fraction of a cent, once the freshly minted supply reached the market.

Truebit acknowledged the incident on X on 8 January, confirmed that a specific contract was affected and told users not to interact with it. The team said it was in contact with law enforcement. No full post-mortem, recovery or compensation plan had been published, and no suspect has been named.