Truebit Protocol Hit by $26.6M Exploit, TRU Token Crashes 99.9%

• Truebit exploit drains $26.6 million in ETH: An attacker exploited a flaw in a five-year-old smart contract to mint and sell TRU tokens, extracting funds from reserves.
• TRU token value obliterated: The native token fell from approximately $0.16 to near zero, losing 99.9% of its value amid liquidity evaporation.
• Protocol response underway: Truebit is coordinating with law enforcement and has warned users against interacting with the affected contract.

The Truebit protocol, designed for scalable Ethereum verification and off-chain computation, has been compromised in what appears to be the first major DeFi hack of 2026. An attacker exploited a vulnerability in an older smart contract, draining approximately 8,535 Ethereum (ETH) valued at $26.6 million. This incident underscores ongoing security challenges in decentralized finance, particularly with legacy code.

The exploit targeted a minting function in the contract at address 0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2, which returned a zero purchase price for extraordinarily large token amounts. This allowed the hacker to mint vast quantities of TRU tokens essentially for free, then sell them back to the bonding-curve reserve to extract ETH, repeating the process in loops. Onchain analysts, including Lookonchain and independent researcher “n0b0dy,” detailed the mechanism, noting the attacker used a bribe to prioritize transactions.

Following the breach, Truebit’s native token TRU plummeted 99.9%, dropping from around $0.16 to an all-time low of $0.0000000029, according to data from Nansen. Liquidity pools dried up as holders exited positions, effectively wiping out the token’s market value. The protocol has not confirmed if user funds beyond reserves were affected, but the event raises questions about audit practices for aging contracts.

In a statement on X, Truebit acknowledged the incident: “Today, we became aware of a security incident involving one or more malicious actors. The affected smart contract is 0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2, and we strongly advise the public not to interact with this contract until further notice. We are in contact with law enforcement…” The team has yet to release a full post-mortem, but emphasized steps to mitigate further risks.

Security experts warn that such vulnerabilities highlight the need for continuous contract monitoring. Weilin Li, a researcher cited in reports, attributed the flaw to outdated deployment practices. While DeFi has matured, incidents like this could erode investor confidence, especially amid broader market pressures from ETF outflows and macroeconomic shifts.

For context, onchain data from the exploit can be viewed via the attacker’s wallet and related transactions. Verified X accounts like @Truebitprotocol provide official updates.

Disclaimer: This article is for informational purposes only and does not constitute advice of any kind. Readers should conduct their own research before making any decisions.