Truebit: Integer Overflow in Unverified Bytecode / Bonding Curve Exploit
Truebit's 5-year-old unverified contract — with a publicly flagged "rug zone" bonding curve and an exploit function literally named "Attack" — was finally drained for $26.2M by the same wallet that hit Sparkle protocol 12 days earlier.
Summary #
Truebit suffered a Layer 2 / Compute Verification Protocol (with token bonding curve) on 2026-01-08, resulting in a loss of approximately $26M.
What happened #
Truebit's 5-year-old unverified contract — with a publicly flagged "rug zone" bonding curve and an exploit function literally named "Attack" — was finally drained for $26.2M by the same wallet that hit Sparkle protocol 12 days earlier.