TLDR
Truebit (TRU) was exploited today, with roughly 8,535 ETH (~$26 million) drained according to multiple reports and on?chain monitors (Cointelegraph update).
- Root cause appears to be a pricing logic bug enabling free mints and sell?backs that drained ETH reserves (Truebit exploit report).
- Activity centers on the Purchase contract at 0x764C2EF2 flagged in alerts and trackers (contract label coverage).
- The team said it is working with law enforcement and TRU collapsed after the incident (market reaction write?up).
Deep Dive
1. Amount and Asset
Reports cite about 8,535 ETH removed from Truebits protocol flows today, equating to roughly $2627 million at recent prices. Cointelegraph noted Truebit publicly acknowledged a security incident and that sleuths tracked the ETH movements tied to the exploit (Cointelegraph update).
- On?chain watchers highlighted transactions labeled Attack and linked flows that add up near ~$26 million in ETH (Yahoo Finance coverage).
A single contract path appears to have enabled withdrawing ETH reserves at scale, making this a protocol?level drain rather than a scattered wallet campaign.
2. Mechanism
A pricing logic flaw reportedly returned a zero price for large purchase requests, allowing attackers to mint tokens for free and then sell them back into the bonding curve to extract ETH repeatedly (Truebit exploit report).
- The vulnerable path is associated with the Purchase contract at 0x764C2EF2, a label that surfaced across alert systems and media summaries (contract label coverage).
When pricing logic fails at edge conditions, bonding?curve reserves can be siphoned quickly. Smart contract economic checks are as critical as access control.
3. Status and Risk
Truebit stated it is engaging law enforcement and taking mitigation steps. The TRU token price collapsed after the exploit, reflecting confidence shock and liquidity uncertainty (market reaction write?up).
- Some monitoring posts noted consolidation of stolen ETH and fast follow?on transfers from the primary path, consistent with pre?planned cash?out behavior (see the reports above).
Until the contract is paused or patched and a post?mortem clarifies scope, treat protocol interactions as high risk. If you had approvals or exposure, review them and consider reducing touchpoints to the affected contract.
Conclusion
Todays ETH drain was tied to a Truebit (TRU) contract path, with a pricing bug enabling free mints and sell?backs that emptied bonding?curve ETH reserves. The immediate effect is technical and reputational damage, plus market dislocation in TRU. The prudent stance is caution on interactions until the teams forensic details and fixes are published.
Confidence: moderate because details are still emerging. Verify quickly by checking the projects next official update and the contract address noted above.
CoinsKid.Com