Truebit’s TRU Token Collapses After $26.6M Ethereum Exploit

Truebit’s TRU token tumbled nearly 100% on Thursday after an attacker drained roughly 8,535 ETH — about $26.6 million — from the protocol’s reserves, according to on-chain data and independent researchers.

The hacker exploited a flaw in a legacy smart contract, allowing them to mint TRU at virtually no cost and repeatedly sell it back to the bonding-curve reserve to extract Ether. Analysts described the attack as a series of buy-and-sell loops that exploited mispricing as the reserve balance shifted. A small builder bribe reportedly helped prioritize the transactions.

Truebit, an Ethereum-based verification and computation project, confirmed the incident and said it is working with law enforcement while taking steps to mitigate the impact.

The vulnerability originated in a smart contract deployed about five years ago, where unusually large token purchases could register at zero cost. The exploit triggered a near-total collapse in TRU liquidity, with the token falling as much as 99.9%.

The event highlights the persistent risks of legacy smart contracts: even updated protocols can remain exposed if older deployments retain value or connect to reserves. Truebit has not yet released a full post-mortem or confirmed whether affected contracts have been paused.