Truebit Token TRU Reset to Zero in Major Hack, $26M in ETH Stolen

The Truebit protocol confirmed a major security incident involving one of its smart contracts, with attackers draining more than 8,500 ETH from the system. The exploit occurred on 7 January 2026, and the affected contract is labeled labeled 'Truebit Protocol: Purchase'. The stolen funds are valued at approximately $26–26.5 million at current prices, according to on-chain analysis.

The TRU token price experienced a dramatic drop following the incident. Within 12 hours, the token fell from around $0.16 to $0.005, representing a loss of more than 99% in value. The collapse reflects investor concern over the scale of the loss and the lack of immediate clarity on recovery efforts. The incident has raised questions about the security of smart contracts and the risks associated with token minting mechanisms.

On-chain data suggests the exploit was enabled by a pricing flaw in the contract's 'getPurchasePrice[uint256]' function. This flaw allowed attackers to mint tokens at no cost by triggering the contract to return a zero price for large mint requests. The attackers then used the newly minted tokens in a rapid buy-sell loop, effectively draining the protocol's ETH reserves.

Why Did This Happen?

The attack exploited a specific vulnerability in the contract logic. According to analysis, the function responsible for calculating purchase prices failed under certain conditions, allowing attackers to bypass the expected cost structure. This enabled them to mint tokens at no cost and then sell them back to the protocol's bonding curve for ETH according to transaction analysis.

The exploit was deliberate, as indicated by the use of a function explicitly labeled 'Attack' in the transaction. This deliberate labeling suggests the attack was pre-planned.

How Did Markets React?

The TRU token's price drop was one of the most severe recorded in recent months. According to Nansen data, the token fell to $0.0000000029, from approximately $0.16 before the incident. The market reaction was swift, with traders reacting to the scale of the loss and the uncertainty around how the protocol would address the breach according to market analysis.

The TRU token is not the only asset affected. The incident adds to a broader trend of rising crypto-related crime in 2025. According to Chainalysis, illicit cryptocurrency transactions increased to about $154 billion in 2025, driven primarily by stolen funds. This trend highlights the growing economic incentives for exploiting vulnerabilities.

What Are Analysts Watching Next?

Following the exploit, roughly half of the stolen ETH was moved through Tornado Cash, a popular privacy-focused mixer. The rapid use of mixing services suggests the attackers were aware of the visibility of blockchain transactions and sought to obscure the trail of funds.

Truebit has not yet announced recovery plans or whether users will be compensated for their losses. The protocol has indicated it is working with law enforcement and will provide updates through official channels. The lack of detailed technical disclosure also leaves many uncertainties about the full scope of the breach and the potential for future attacks.

Investors and analysts are now watching closely to see how Truebit addresses this breach and what steps will be taken to restore user confidence. The incident serves as a reminder of the risks associated with complex smart contract systems and the importance of thorough security audits.