Truebit confirmed a major smart-contract exploit on Jan. 7 that drained more than 8,500 ETH (roughly $26–26.5 million at current prices) from its protocol. What happened - Truebit posted on X that it detected malicious activity tied to the “Truebit Protocol: Purchase” contract (0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2) and warned users not to interact with the address. - The team said it is liaising with law enforcement and will share updates through official channels, but it has not yet published a full technical postmortem. How the exploit worked (on-chain analysis) - Investigators examining the blockchain say the root cause appears to be a pricing logic bug in the contract’s getPurchasePrice[uint256] function. - For unusually large mint requests the function reportedly returned a zero price, letting attackers mint tokens for free. - Attackers repeatedly minted tokens at zero cost and sold them back into the protocol’s bonding curve, siphoning ETH via a rapid buy-sell loop. - One notable exploit transaction even called a function labeled “Attack.” - Most of the stolen funds were consolidated into a single wallet, with a smaller portion moved to a secondary address. Roughly half of the ETH was routed through Tornado Cash shortly after the heist, suggesting a premeditated laundering step rather than an opportunistic grab. Market impact - TRU plunged more than 60% on the news, collapsing from about $0.16 to $0.005 in a single 12-hour candle on major exchanges (source: TradingView). The sharp selloff reflects panic around the scale of the loss and uncertainty over remediation or compensation. Wider context - The Truebit incident arrives amid a surge in crypto-related crime. Chainalysis reports illicit crypto flows jumped sharply in 2025 — driven largely by stolen funds and activity tied to sanctioned entities — reaching roughly $154 billion for the year. - The attack underscores how economically motivated actors continue to exploit weaknesses in smart contract pricing and token-issuance logic, especially in protocols that use bonding curves to set prices based on supply. What’s next - Truebit has not yet said whether it will attempt to recover funds or compensate affected users. The project has reiterated it will post updates through official channels as the investigation progresses. Disclaimer This report is informational and not investment advice. Trading or holding crypto is high-risk; do your own research before making decisions. Read more AI-generated news on: undefined/news

#ETH