Breaches and incidentsBriefConfirmed by two or more outlets
Truebit: integer overflow in a five-year-old purchase contract allowed near-free minting
8 Jan 2026: about 8,535 ETH (about USD 26.4M to 26.6M) drained.
- Disclosed
What happened
- 8 Jan 2026: about 8,535 ETH (about USD 26.4M to 26.6M) drained. TRU fell 99.9%.
- Root cause: the pricing function in an old Purchase contract (deployed about five years earlier) returned near-zero ETH cost due to missing overflow protection, so the attacker minted TRU cheaply and burned it for ETH in a loop within one transaction (SlowMist, Cantina, independent researchers).
- Attribution: none.
- Response: Truebit said it was “in contact with law enforcement”. Funds went to Tornado Cash.
Sources
- https://www.theblock.co/post/384861/truebit-26-million-exploit
- https://www.halborn.com/blog/post/explained-the-truebit-hack-january-2026
- https://www.web3isgoinggreat.com/single/truebit-exploit
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.