Truebit, a blockchain project that helps with off-chain computation, recently faced a major security breach that cost $26 million. A flaw in one of its smart contracts allowed a hacker to create a huge number of TRU tokens almost for free. This caused the price of the TRU token to crash by 99%, nearly wiping out its value.

The issue came from an error in the way Truebit’s smart contract calculated token prices. According to security firm SlowMist, the contract didn’t have proper protection against what’s known as an “overflow” error. This happens when a calculation goes beyond the limit of what the system can handle, causing it to reset and produce incorrect results. In this case, the system thought the cost to mint new tokens was zero, so the attacker was able to create $26 million worth of tokens without spending any ETH.

The vulnerable contract was written using Solidity version 0.6.10, which doesn’t automatically check for overflow errors. Because of this, the attacker exploited the mistake and drained the protocol’s reserves.

This exploit is a reminder that even older and established blockchain projects can have dangerous bugs hiding in their code. Truebit has been around since April 2021 and was seen as a trusted platform until this happened.

Smart contract security has become a hot topic lately. A recent study by Anthropic showed that AI systems, like Claude and GPT-5, were able to find $4.6 million worth of vulnerabilities in smart contracts during testing. This shows how powerful both AI tools and hackers can be when looking for weaknesses.

In 2025, smart contract bugs were the biggest source of crypto attacks, responsible for 56 incidents. Account hacks came in second with 50 cases, according to a year-end report by SlowMist. Smart contract flaws made up 30.5% of all crypto exploits, followed by hacked social media accounts at 24%, and leaked private keys at 8.5%.

Hackers are also changing tactics. Instead of just attacking code, many are now targeting people directly through phishing scams. These scams trick users into giving away sensitive info like wallet recovery phrases or private keys through fake websites or messages.

Phishing was the second biggest threat in 2025, causing $722 million in losses across 248 incidents. While that number is huge, it’s actually down 38% from the $1 billion lost to phishing in 2024—showing that more users are becoming aware of these dangers.

This Truebit hack is another wake-up call for the crypto industry about how important it is to keep smart contracts secure and up-to-date. As more value moves onto blockchain networks, even small coding mistakes can lead to massive financial damage.