Wu Shuo learned that, according to the SlowMist report, Truebit Protocol was subjected to a smart contract vulnerability attack on January 8, 2026. Due to an unprotected integer addition overflow in the Purchase contract's price calculation (Solidity 0.6.10 has no built-in overflow checks), the attacker crafted an extreme minting amount to cause the minting price to be calculated as 0, repeatedly performing "mint—destroy" arbitrage. This ultimately drained the contract's reserves, netting approximately 8,535 ETH (about $26.44 million). The stolen funds were subsequently funneled into privacy tools such as Tornado Cash.