Truebit Protocol suffered a smart contract vulnerability attack on January 8, 2026, as reported by SlowMist. The attack exploited an unprotected integer overflow in the Purchase contract's price calculation, due to the lack of overflow checks in Solidity 0.6.10. The attacker manipulated the minting process to set the token price to zero, repeatedly executing a 'mint-burn' arbitrage strategy. This drained the contract's reserves, resulting in a profit of approximately 8,535 ETH, valued at $26.44 million. The stolen funds were subsequently funneled through privacy tools like Tornado Cash.