{"id":"truebit-reserves-drained-integer-overflow-jan-2026","category":"breach","status":"closed","title":"Truebit protocol drained of 8,535 ETH (about US$26.6 million) through old-contract integer overflow","tldr":"An attacker used an arithmetic overflow in Truebit's roughly five-year-old contract to buy TRU for nothing and take 8,535 ETH (US$26.6M). TRU fell 99.9%. No recovery or compensation found. If you hold TRU or use Truebit, don't interact with its contracts.","summary":"On 8 January 2026 an attacker drained about 8,535 ETH, worth roughly US$26.6 million, from the reserve of Truebit, an Ethereum project. The target was an older smart contract, reportedly deployed around 2021 and written in a Solidity version before 0.8.0, which does not check for arithmetic overflow. CertiK says a price calculation overflowed and returned zero for a huge purchase of TRU, so the attacker minted tokens free and sold them back into the reserve. The TRU token fell as much as 99.9%. A second attacker took a smaller sum of about 224,000 (currency not stated), and CertiK says 71 ETH from it went to Tornado Cash, a mixing service. Truebit said it was working with law enforcement and told people to avoid the contract. A search summary of later coverage says the stolen funds were run through Tornado Cash and no compensation plan had been announced by mid-January. I found no confirmed recovery, arrests or reimbursement. There is nothing to patch: the funds are gone, and the main risk is to people holding TRU or interacting with Truebit contracts.","action":"If you hold TRU or have funds in Truebit, don't interact with the affected contract, and treat any \"recovery\" or \"compensation\" message as a likely scam unless Truebit's official channels confirm it. Otherwise nothing for you to do.","product":"Truebit Protocol (TRU token, Ethereum smart contract)","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["truebit","tru","crypto-theft","ethereum","defi","integer-overflow","smart-contract","tornado-cash"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Truebit incident analysis","url":"https://www.certik.com/blog/truebit-incident-analysis","by":"CertiK","date":"2026-01-09"},{"kind":"news","title":"Truebit token TRU crashes 99.9% after US$26.6M exploit drains 8,535 ETH","url":"https://www.coindesk.com/markets/2026/01/09/truebit-token-tru-crashes-99-9-after-usd26-6m-exploit-drains-8-535-eth","by":"CoinDesk","date":"2026-01-09"},{"kind":"news","title":"Truebit exploited for over $26 million","url":"https://www.web3isgoinggreat.com/single/truebit-exploit","by":"Web3 is Going Just Great","date":"2026-01-08"},{"kind":"post","title":"Truebit Protocol statement on X","url":"https://twitter.com/Truebitprotocol/status/2009328032813850839","by":"Truebit Protocol","date":"2026-01-08"}],"started":"2026-01-08","closed":"2026-01-15","created":"2026-11-03T21:29:10.411Z","updated":"2026-11-03T21:29:10.411Z","cve_notes":[],"timeline":[{"at":"2026-01-15","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"A search summary reports Truebit said it had engaged extra resources for tracing and recovery. It also reports the stolen ETH moved through intermediary wallets into Tornado Cash, and that no compensation plan had been announced by mid-January. I could not open the underlying pages, so this is unconfirmed.","url":"https://www.web3isgoinggreat.com/single/truebit-exploit","by":"Web3 is Going Just Great","patch":"na"},{"at":"2026-01-09","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"Truebit said it was aware of a security incident, told people not to interact with the affected contract, and said it was in contact with law enforcement. TRU fell as much as 99.9%. It had not published a full post-mortem or confirmed whether the contracts were paused.","url":"https://www.coindesk.com/markets/2026/01/09/truebit-token-tru-crashes-99-9-after-usd26-6m-exploit-drains-8-535-eth","by":"CoinDesk","patch":"na"},{"at":"2026-01-09","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"CertiK reported that the first attacker had split the stolen ETH across two wallets, and that a second attacker took a further sum of about 224,000 (currency not stated) and sent 71.03 ETH to Tornado Cash. No recovery was mentioned.","url":"https://www.certik.com/blog/truebit-incident-analysis","by":"CertiK","patch":"na"},{"at":"2026-01-08T16:02Z","added":"2026-11-03T21:28:26.316Z","kind":"disclosed","text":"The main exploit transaction hit Truebit's older purchase contract. The attacker bought TRU at a price calculated as zero, then sold it back into the reserve for 8,535.36 ETH, about US$26.6 million.","url":"https://www.certik.com/blog/truebit-incident-analysis","by":"CertiK","patch":"na"}],"url":"https://hard.fyi/live/truebit-reserves-drained-integer-overflow-jan-2026/","json":"https://hard.fyi/api/live?id=truebit-reserves-drained-integer-overflow-jan-2026"}