On January 9th early morning, a sudden attack turned the Truebit Protocol contract deployed five years ago into a "cash machine"—the attacker drained 8,535.36 ETH from the contract in a short period, worth approximately $26.4 million at the time.

The security team's analysis uncovered the details of this incident. The attack method was not complicated but highly effective.

**The attack process was as follows:**

First, the attacker used the getPurchasePrice( function to probe price information. Then, they targeted a flawed function within the contract, initiating calls with a very small msg.value. Since the contract code was not open source, decompilation suggested that this function had an arithmetic logic vulnerability—most likely improper handling of integer truncation—allowing the attacker to mint a large amount of TRU tokens out of thin air.

The key step was then to use the burn function to "sell back" these artificially created tokens to the contract, extracting real ETH in the process. This operation was repeated five times, with msg.value gradually increasing each time, ultimately nearly draining the ETH reserves of the contract.

This incident served as a wake-up call for the industry—even projects deployed five years ago, if their contract logic contains vulnerabilities and is not promptly updated, can still become targets for hackers.