Truebit

Planet

Opus

Opus Genesis

<h4>Quick Breakdown&nbsp;</h4>
<ul>
 <li style="font-weight: 400;">Truebit lost $26 million after a smart contract overflow bug allowed attackers to mint TRU tokens at near-zero cost.</li>
 <li style="font-weight: 400;">The exploit caused a 99% crash in TRU’s price, highlighting risks tied to outdated Solidity versions.</li>
 <li style="font-weight: 400;">Smart contract flaws remain crypto’s biggest threat, even as phishing and social engineering attacks rise.</li>
</ul>
&nbsp;
A critical smart contract flaw has led to a $26 million exploit of the offline computation protocol Truebit, wiping out nearly all the value of its native TRU token and reigniting concerns about long-standing smart contract vulnerabilities.
<blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f6a8.png" alt="🚨" style="height: 1em; max-height: 1em;">SlowMist: Analysis of Truebit Protocol Incident<img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f6a8.png" alt="🚨" style="height: 1em; max-height: 1em;">
 On Jan 8, <a href="https://twitter.com/Truebitprotocol?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Truebitprotocol</a> was exploited via an integer overflow vulnerability in its Purchase contract, allowing the attacker to mint <a href="https://twitter.com/search?q=%24TRU&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$TRU</a> at near-zero cost and drain 8,535 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a> (~$26.44M) <img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f4b0.png" alt="💰" style="height: 1em; max-height: 1em;">
 <img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f50d.png" alt="🔍" style="height: 1em; max-height: 1em;"> Root cause: Missing overflow… <a href="https://t.co/OCzQTjOwDJ" rel="noopener noreferrer nofollow">https://t.co/OCzQTjOwDJ</a> <a href="https://t.co/0zL7AfDgHY" rel="noopener noreferrer nofollow">pic.twitter.com/0zL7AfDgHY</a>
 — SlowMist (@SlowMist_Team) <a href="https://twitter.com/SlowMist_Team/status/2010668738195202157?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">January 12, 2026</a>
</blockquote>

Blockchain security firm SlowMist <a style="color: #0000ff;" href="https://slowmist.medium.com/26-44-million-stolen-truebit-protocol-smart-contract-vulnerability-analysis-e44fe7becd8a" rel="noopener noreferrer nofollow">published</a> a post-mortem analysis on Monday, explaining that the exploit stemmed from faulty smart contract logic rather than a sophisticated external hack.
The incident, first <a style="color: #0000ff;" href="https://defi-planet.com/2026/01/truebit-exploit-drains-26m-eth-crashes-tru-token-100/" rel="noopener noreferrer nofollow">reported</a> on Friday, saw the Truebit (TRU) token plunge by 99% after an attacker exploited a loophole that allowed tokens to be minted at virtually no cost.
<h3 id="span-style-font-weight-400-overflow-bug-enabled-near-free-token-minting-span">Overflow bug enabled near-free token minting</h3>
According to SlowMist, the attacker took advantage of a missing overflow protection mechanism in Truebit’s Purchase contract. The contract miscalculated the amount of ETH required to mint TRU tokens due to an integer overflow in an addition operation.
Because the contract was compiled using Solidity version 0.6.10, a version that lacks built-in overflow checks, calculations that exceeded the maximum uint256 value silently wrapped around, producing a value close to zero.
This error effectively reduced token minting costs to nothing, allowing the attacker to generate and drain roughly $26 million worth of TRU tokens from the protocol’s reserves.
<h3 id="span-style-font-weight-400-old-protocols-new-risks-for-crypto-security-span">Old protocols, new risks for crypto security</h3>
The exploit is a stark reminder that even established blockchain projects remain exposed to security risks. Truebit launched on Ethereum’s mainnet in April 2021, making the vulnerability particularly concerning given the protocol’s age.
Smart contract flaws continue to dominate crypto attack vectors. SlowMist’s 2025 year-end <a style="color: #0000ff;" href="https://www.slowmist.com/report/2025-Blockchain-Security-and-AML-Annual-Report(EN).pdf" rel="noopener noreferrer nofollow">report</a> reveals that contract vulnerabilities accounted for 30.5% of all crypto exploits last year, with 56 reported incidents, surpassing any other category.
Security research is also evolving rapidly. An Anthropic study published late last year found that AI models, including Claude Opus 4.5, Claude Sonnet 4.5, and OpenAI’s GPT-5, collectively identified smart contract exploits worth $4.6 million during controlled testing.
Meanwhile, attackers are increasingly shifting away from protocol hacks toward social engineering. Crypto phishing scams emerged as the second-largest threat in 2025, costing investors $722 million across 248 incidents, according to CertiK. Although this figure represents a 38% drop from 2024, it suggests growing user awareness.
&nbsp;
If you would like to read more articles like this, visit<a style="color: #0000ff;" href="https://defi-planet.com/wp-content/uploads/2025/09/Barriers-and-Skepticism-in-Apples-crypto-security-push-1-3.avifwp-content/uploads/2025/09/Barriers-and-Skepticism-in-Apples-crypto-security-push-1-2.avifwp-content/uploads/2025/10/Proof-of-Personhood-A-Privacy-First-Approach-to-Identity-Verification-scaled-1.avifwp-content/uploads/2025/10/Are-We-Ignoring-the-Ethics-of-Crypto-Staking-scaled-2.avifwp-content/uploads/2025/10/Slippage-Front-Running-and-MEV-The-Hidden-Costs-of-DeFi-Trading-scaled-1.avifwp-content/uploads/2025/09/Next-Technology-Holding-1.avifwp-content/uploads/2025/09/Next-Technology-Holding-1.avifwp-content/uploads/2025/10/Russian-Ruble-Backed-Stablecoin-A7A5-1.avifwp-content/uploads/2025/10/IoTeX-1.avifwp-content/uploads/2025/09/Pepeto-eth-ethereum__17576735955xmMW0sU5j-1.jpgwp-content/uploads/2025/10/featured_BitMine_Dark_Background___Logo_1759753804_1759753804OCMtn2Egta-1.avif" rel="noopener noreferrer nofollow"> DeFi Planet</a> and follow us on<a style="color: #0000ff;" href="https://twitter.com/PlanetDefi" rel="noopener noreferrer nofollow"> Twitter</a>,<a style="color: #0000ff;" href="https://www.linkedin.com/company/defi-planet/" rel="noopener noreferrer nofollow"> LinkedIn</a>,<a style="color: #0000ff;" href="https://www.facebook.com/DeFi-Planet-129907662611402" rel="noopener noreferrer nofollow"> Facebook</a>,<a style="color: #0000ff;" href="https://www.instagram.com/defi.planet/" rel="noopener noreferrer nofollow"> Instagram</a>, and<a href="https://coinmarketcap.com/community/profile/DeFiPlanet/" rel="noopener noreferrer"> CoinMarketCap Community</a>.
Take control of your crypto&nbsp; portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
The post <a href="https://defi-planet.com/2026/01/slowmist-gives-analysis-on-truebit-26m-exploit/" rel="noopener noreferrer nofollow">SlowMist Gives Analysis on Truebit $26M Exploit</a> appeared first on <a href="https://defi-planet.com" rel="noopener noreferrer nofollow">DeFi Planet</a>.

SlowMist Gives Analysis on Truebit $26M Exploit

Table of Contents

DeFi Planet

Other articles published on Jan 13, 2026

Join our free newsletter for daily crypto updates!