Overview
- Truebit confirmed malicious activity tied to contract 0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2, urged users to avoid it, and said it is working with law enforcement.
- On-chain analysts attribute the breach to a getPurchasePrice logic error that returned zero for large mints on a roughly five-year-old contract.
- The exploiter ran rapid buy–sell loops against the bonding curve to extract about 8,535 ETH, with researchers noting a small builder bribe to prioritize transactions.
- Stolen funds were split across two main wallets (including 0x2735…cE850a and 0xD12f…031a60) and roughly half moved through Tornado Cash.
- TRU’s price fell to near zero and DEX liquidity evaporated, while the team has not released a full post-mortem or any recovery plan.