Overview
- Truebit confirmed the breach and urged users to avoid the affected purchase contract at 0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2.
- On-chain analysts including Lookonchain and CertiK corroborated losses of roughly 8,535 ETH, valued at about $26–26.6 million.
- The flaw in the getPurchasePrice function returned a zero price on large mint requests, enabling repeated buy‑sell loops against the bonding curve.
- Investigators traced consolidation of proceeds into a primary address with roughly half of the ETH quickly routed through Tornado Cash, and one transaction invoked a function labeled “Attack” with a small builder bribe reported.
- Truebit said it is working with law enforcement and has not announced a recovery or compensation plan as liquidity and confidence in TRU evaporated.