Truebit Protocol Suffers $26.4M Exploit in Smart Contract Breach

The Truebit Protocol, an Ethereum scaling solution, recently suffered a major security breach involving its smart contract. Hackers drained approximately 8,535 ETH from its Purchase smart contract, valued at around $26.4 million at current prices. Analysts are speculating whether the incident was a hack or an internal issue.

The incident could represent the first significant DeFi breach of 2026 for the protocol. The Truebit team acknowledged and responded to the on-chain flaw, but there has been no official statement from their X account.

$26.4 Million Exploit Uncovered

The exploit targeted a weakness in the bonding curve, allowing free minting and selling of TRU tokens. Blockchain security firm Cyvers quickly raised concerns after identifying unusual transfer patterns. Analysts believe that a vulnerability occurred in the bonding-curve system. The getPurchasePrice method incorrectly returned 0 for large mint amounts. 

The attacker exploited a loophole that allowed them to buy and sell assets repeatedly without incurring any costs. They transferred funds to various addresses, including some linked to mixers, and burned a significant number of TRU tokens. The gas fees were about 0.0016 ETH.

The Truebit Protocol improves Ethereum by enabling smart contracts to perform complex calculations off-chain. It uses verification games to ensure accuracy and maintain trust in the process. However, previous audits failed to identify a specific vulnerability within the system. 

Will a Bounty Work Again?

Upon noticing the damage, the Truebit team quickly sent an on-chain message to the exploiter. The message suggests the team views the exploiter as a potential white-hat hacker and is offering a 20% bounty in exchange for the return of the stolen funds.

As of now, no funds have been returned based on available on-chain data. Meanwhile, the crypto space has seen instances of attackers returning stolen assets after accepting bounties. For example, the hacker behind the $40 million GMX exploit returned the funds after accepting a 10% bounty offer from the project. The crypto community is waiting to see if this long-tested strategy will yet yield the desired result.

The post Truebit Protocol Suffers $26.4M Exploit in Smart Contract Breach appeared first on CoinTab News.