On January 9th early morning, a previously undisclosed contract deployed by Truebit Protocol was successfully exploited by an attacker, resulting in a loss of 8,535.36 ETH, equivalent to approximately $26.4 million. The security team conducted an in-depth investigation and analysis of the incident.

Attack Process Breakdown

Main attack transaction hash: 0xcd4755645595094a8ab984d0db7e3b4aabde72a5c87c4f176a030629c47fb014

The attacker’s steps are quite clear:

First, call the getPurchasePrice() function to query price information. Then, move to the core vulnerability—call the flawed function 0xa0296215() with a very low msg.value. Since the contract source code is not public, decompilation results show that this function has an arithmetic logic vulnerability, likely due to improper integer truncation. Because of this, the attacker was able to mint a large amount of TRU tokens out of thin air.

Next is the cash-out phase. The attacker uses the burn function to "sell" the minted tokens back to the contract, extracting a large amount of ETH. This process was repeated 4 times, each time increasing the msg.value, ultimately nearly draining the contract’s ETH reserves.

Funds Chain Tracking

Based on on-chain data, the team used blockchain investigation and tracking tools to trace the flow of the stolen funds… (The original text does not provide further details)