In the early morning of January 9th, a sudden attack turned a smart contract deployed by Truebit Protocol five years ago into an "ATM"—attackers drained 8,535.36 ETH from the contract in a short period of time, worth approximately $26.4 million at that price.

The security team's analysis unveiled the details of this incident. The attack methodology was not complex, but proved to be exceptionally effective.

**The attack process was as follows:**

First, attackers called the getPurchasePrice() function to probe price information. Next, they targeted a flawed function in the contract, initiating calls with extremely small msg.value. Since the contract code was not open-sourced, through decompilation it was inferred that this function contained arithmetic logic vulnerabilities—likely improper integer truncation handling, which allowed attackers to mint a large amount of TRU tokens out of thin air.

Then came the critical step: using the burn function to "sell back" these counterfeit tokens to the contract, extracting real ETH in the process. This operation was executed repeatedly 5 times, with msg.value increasing incrementally each time, ultimately draining almost all ETH reserves from the contract.

This incident sounded an alarm for the industry—even "established" projects deployed five years ago can become targets in hackers' sights if their contract logic contains vulnerabilities and fail to be updated in time.