Loss Exceeding $26 Million: Analysis of Truebit Protocol Security Incident and Tracking of Stolen Funds Flow

marsbitPublicado a 2026-01-09Actualizado a 2026-01-09

Resumen

On January 9, the Truebit Protocol suffered an attack resulting in a loss of 8,535.36 ETH (approximately $26.4 million) due to an exploit in a five-year-old unaudited and unopen-sourced contract. The attack involved a suspected arithmetic logic flaw, possibly due to integer truncation, in an unverified function (0xa0296215). The attacker repeatedly called this function with a minimal msg.value to mint a large number of TRU tokens, which were then burned to withdraw ETH from the contract’s reserves. According to Beosin’s analysis, the stolen funds—totaling 8,535.36 ETH—were primarily transferred to two addresses: 0xd12f6e0fa7fbf4e3a1c7996e3f0dd26ab9031a60 (holding 4,267.09 ETH) and 0x273589ca3713e7becf42069f9fb3f0c164ce850a (holding 4,001 ETH). The attacker’s address (0x6c8ec8f14be7c01672d31cfa5f2cefeab2562b50) still retains 267.71 ETH. All related addresses have been flagged as high-risk by Beosin KYT. The incident underscores the importance of security audits, contract upgrades, and incorporating emergency pause mechanisms and modern Solidity safety features to mitigate risks in legacy smart contracts.

Author: Beosin

In the early hours of January 9, an unopen-sourced contract deployed by Truebit Protocol 5 years ago was attacked, resulting in a loss of 8,535.36 ETH (worth approximately $26.4 million). The Beosin security team conducted an analysis of the vulnerability and fund tracking for this security incident and shares the results as follows:

Attack Technique Analysis

For this incident, we take the most significant attack transaction as the analysis subject, with the transaction hash: 0xcd4755645595094a8ab984d0db7e3b4aabde72a5c87c4f176a030629c47fb014

1. The attacker calls getPurchasePrice() to obtain the price

2. Subsequently calls the flawed function 0xa0296215(), setting the msg.value extremely low

Since the contract is not open-source, it is inferred from the decompiled code that this function has an arithmetic logic vulnerability, such as integer truncation issues, allowing the attacker to successfully mint a large number of TRU tokens.

3. The attacker "sells back" the minted tokens to the contract through the burn function, extracting a large amount of ETH from the contract reserves.

This process is repeated 4 more times, with the msg.value increasing each time, until almost all ETH in the contract is extracted.

Stolen Funds Tracking

Based on on-chain transaction data, Beosin conducted a detailed fund tracking through its blockchain on-chain investigation and tracking platform, BeosinTrace, and shares the results as follows:

Currently, the stolen 8,535.36 ETH, after transfers, are mostly held in 0xd12f6e0fa7fbf4e3a1c7996e3f0dd26ab9031a60 and 0x273589ca3713e7becf42069f9fb3f0c164ce850a.

Among them, address 0xd12f holds 4,267.09 ETH, and address 0x2735 holds 4,001 ETH. The address from which the attacker initiated the attack (0x6c8ec8f14be7c01672d31cfa5f2cefeab2562b50) still holds 267.71 ETH. There have been no further fund transfers from these three addresses yet.

Stolen Funds Flow Analysis Diagram by Beosin Trace

The above addresses have been marked as high-risk addresses by Beosin KYT. Taking the attacker's address as an example:

Beosin KYT

Conclusion

This stolen fund incident involves an unopen-sourced smart contract from 5 years ago. For such contracts, the project team should upgrade the contract, introduce emergency pause functions, parameter limitations, and new Solidity security features. Furthermore, security audits remain an essential step for contracts. Through security audits, Web3 enterprises can comprehensively detect smart contract code, identify and fix potential vulnerabilities, and enhance contract security.

*Beosin will provide a complete analysis report of all fund flows and address risks for this incident. Welcome to request it via the official email [email protected].

Preguntas relacionadas

QWhat was the total amount of ETH stolen in the Truebit Protocol security incident?

A8,535.36 ETH, valued at approximately $26.4 million.

QWhich function did the attacker call to exploit the vulnerability in the unopened contract?

AThe attacker called the function 0xa0296215() with a very small msg.value to exploit an arithmetic logic vulnerability, likely due to integer truncation issues.

QHow did the attacker convert the fraudulently minted TRU tokens into ETH?

AThe attacker used the burn function to 'sell back' the minted TRU tokens to the contract, extracting a large amount of ETH from the contract reserves.

QWhat are the two main addresses where the stolen ETH is currently held?

AThe majority of the stolen ETH is held in addresses 0xd12f6e0fa7fbf4e3a1c7996e3f0dd26ab9031a60 (4,267.09 ETH) and 0x273589ca3713e7becf42069f9fb3f0c164ce850a (4,001 ETH).

QWhat security measures does Beosin recommend to prevent such incidents?

ABeosin recommends upgrading the contract to include emergency pause functions, parameter limits, and new Solidity security features, as well as conducting thorough security audits to detect and fix potential vulnerabilities.

Lecturas Relacionadas

Analyst Forecasts Bitcoin's Movement in August

Analyst Forecasts Bitcoin Movement in August Bitcoin ends July under market caution due to a lack of new macroeconomic catalysts and regulatory uncertainty, according to Bitbanker analyst Andrey Poroshin. He forecasts that in August, BTC may first test the $60,000–$62,000 range before recovering to around $70,000. The analyst notes that the U.S. Federal Reserve's neutral stance provided no strong market signals, with inflation remaining above target. Currently, Bitcoin trades below the U.S. mining cost range of $73,000–$75,000, a key global profitability benchmark, though costs are lower in some countries like Russia. Significant July events include the bankruptcy of derivatives exchange BitMEX, which Poroshin views as a capitulation of weaker market participants, often preceding potential reversal zones. Retail investor activity has declined, with many placing stop orders in the $60,000–$62,000 range, where significant liquidity is concentrated and could be tested. While geopolitical factors like U.S.-Iran tensions are losing market impact, regulatory uncertainty persists as the U.S. CLARITY Act vote was postponed to September. Typically, August sees lower trading activity due to holidays, leading to more technical, less volatile price movements. Poroshin's base scenario for August is a test of $60,000–$62,000 followed by a recovery to $70,000, with more significant moves likely in September post-Fed signals and potential CLARITY Act developments. Separately, a Russian deputy finance minister stated that non-qualified investors in Russia will soon be allowed to legally purchase Bitcoin, Ethereum, and major stablecoins, with an annual limit of 300,000 rubles per intermediary.

cryptonews.ruHace 5 min(s)

Analyst Forecasts Bitcoin's Movement in August

cryptonews.ruHace 5 min(s)

The Blockchain Industry Enters a Phase of Mass Adoption and Efficiency

In Q2 2026, the blockchain industry demonstrated a divergence between market sentiment and fundamental network growth. While on-chain activity surged, network fee revenues declined due to protocol designs making block space cheaper and more abundant. Ethereum saw institutional staking reach an all-time high of 40.2 million ETH. Despite processing nearly double the transactions per second, its network revenue fell 51% YoY to $64 million, with staker yields driven primarily by consensus rewards. Solana processed nearly 10 billion transactions, but its economic value also dropped to $51 million due to reduced congestion. Notably, its real-world asset (RWA) sector boomed, with tokenized stock trading volume growing 2,479x YoY to $3.32 billion in June 2026. Hyperliquid emerged as an outlier, generating $175 million in revenue with 32% of its $652 billion trading volume from non-crypto markets like commodities. Avalanche saw transaction growth but a sharp drop in fee revenue, while focusing on sovereign L1s for enterprise use. The NEAR Protocol ecosystem shifted from gas-intensive apps to Intents-based trading and introduced a novel feature allowing users to pay for AI services via staked tokens. The Tempo network, backed by Stripe and Paradigm, processed $386 million in stablecoin transfers, including $30 million for contractor payouts by Deel. The report concludes that the industry is transitioning from high-fee speculation to a phase of mass adoption and infrastructure efficiency, where cheap block space fuels transaction growth and institutional entry.

cryptonews.ruHace 5 min(s)

The Blockchain Industry Enters a Phase of Mass Adoption and Efficiency

cryptonews.ruHace 5 min(s)

Storage Giants Are Raking It In, Downstream Players Are Struggling to Cope

Global memory storage giants have reported record-breaking earnings, with downstream clients now struggling to bear the soaring costs. SK Hynix's Q2 operating profit surged 557%, while Samsung's DS division hit a historic high. Chinese firms like GigaDevice and Jiangbolong also saw profits skyrocket. However, this profit surge for memory makers translates directly into higher costs for their customers. The boom is largely driven by AI server demand, which consumes high-bandwidth memory (HBM) at the expense of traditional DRAM supply. While cloud providers may accept higher prices, the strain is breaking downstream sectors. In smartphones, memory now comprises over 20% of device costs, even surpassing the main chip in flagship models. This has led manufacturers like OPPO and vivo to reportedly reject further price hikes from suppliers like Samsung. The PC and consumer electronics segments are also weakening, with spot market prices already falling sharply. The industry faces a turning point. Long-term supply agreements are locking in high prices but also capping further increases. As downstream clients from phones to servers push back against unsustainable costs, the memory super-cycle may be approaching a sudden end, driven not by supply shifts but by collapsing demand.

marsbitHace 25 min(s)

Storage Giants Are Raking It In, Downstream Players Are Struggling to Cope

marsbitHace 25 min(s)

BIT Research: Two Major Bearish Factors Continue to Weigh on the Market, Why is Bitcoin Still Near the Cycle Bottom?

Market remains under pressure from a hawkish Federal Reserve and fading regulatory optimism, yet Bitcoin demonstrates resilience near cycle lows. Despite Chairman Kevin Walsh's firm stance keeping Treasury yields elevated and the probability of the CLARITY Act passing in 2026 dropping to 32%, Bitcoin has held within a $62,000-$66,000 range, declining only ~3% over the past week amid these headwinds. Overall market conditions are weak: trading volume is down ~80% from its peak, total market cap has fallen ~50%, and stablecoin supply shows no growth, indicating a lack of fresh dollar liquidity. However, Bitcoin's relative strength versus altcoins suggests significant repositioning may be complete, reducing the likelihood of a sharp further decline. The focus is shifting to whether the cycle bottom is forming. A sustained move above $70,000 could signal the low is in.

marsbitHace 30 min(s)

BIT Research: Two Major Bearish Factors Continue to Weigh on the Market, Why is Bitcoin Still Near the Cycle Bottom?

marsbitHace 30 min(s)

BIS Project Agorá settles $1 million in tokenized cross-border payment trials

The Bank for International Settlements (BIS) has announced the completion of initial real-value trials for Project Agorá, a tokenized cross-border payment system. The trials involved 28 central and commercial banks settling approximately $1 million (800,000 Swiss francs) across 17 different transaction scenarios. The system successfully used tokenized central bank reserves and commercial bank deposits to process payments in six major currencies, with average settlement times of around 80 seconds. Participants included major central banks such as the Bank of England and Bank of Japan, alongside global commercial institutions like JPMorgan Chase and Citi. Launched in 2024, Project Agorá aims to explore how tokenization can improve wholesale cross-border payments, with this phase marking a key milestone. The BIS confirmed testing will continue as the project develops.

cointelegraphHace 41 min(s)

BIS Project Agorá settles $1 million in tokenized cross-border payment trials

cointelegraphHace 41 min(s)

Trading

Spot