Truebit hacker launders $26 million in ETH via Tornado Cash
The attack marks the first major incident targeting a DeFi protocol this year.
The Truebit hacker has laundered all 8,535 ETH stolen, valued at approximately $26 million, through Tornado Cash after exploiting a smart contract vulnerability in the Truebit Protocol on January 8, according to data tracked by Lookonchain.
The #Truebit hacker has deposited all 8,535 $ETH($26.44M) they stole into #TornadoCash and laundered it.https://t.co/nYUNcqv46vhttps://t.co/JLPKkMjkUP pic.twitter.com/0unM8sK3h5
— Lookonchain (@lookonchain) January 11, 2026
The exploit marks the year’s first major DeFi breach. The attacker abused an integer overflow in a legacy smart contract to mint millions of TRU tokens at near-zero cost, then sold them back into the protocol to drain its liquidity.
Today, we became aware of a security incident involving one or more malicious actors. The affected smart contract is 0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2 and we strongly advise the public not to interact with this contract until further notice. We are in contact with law…
— Truebit (@Truebitprotocol) January 8, 2026
The attack crashed TRU by more than 99.9%, wiping out investor value.
Blockchain security firms later linked the wallet to a prior Sparkle Protocol hack, suggesting a highly sophisticated actor.
In response, the Truebit team urged users to halt interactions with the compromised contract, engaged law enforcement, and launched a comprehensive review to assess potential recovery options.