Wu Shuo learned that, according to the SlowMist report, Truebit Protocol was attacked by an smart contract vulnerability on January 8, 2026. Due to an unprotected integer addition overflow in the Purchase contract's price calculation (Solidity 0.6.10 has no built-in overflow checks), the attacker constructed an extreme minting amount to cause the minting price to be calculated as 0, repeatedly performing "mint—burn" arbitrage, ultimately draining the contract reserves and profiting approximately 8,535 ETH (about $26.44 million). The stolen funds were subsequently transferred to privacy tools such as Tornado Cash.