TLDR
- Cyvers detected a suspicious transaction involving 8,535 ETH linked to a Truebit contract.
- The estimated loss from the transaction is approximately $26 million based on current ETH prices.
- Truebit’s TRU token dropped by 99.95 percent in one day, triggering alarm across trading venues.
- The affected Ethereum address is labeled as a Truebit purchase contract on Etherscan.
- Confusion between Truebit and TrueFi due to the shared TRU ticker has caused past trading errors.
Cyvers Alerts identified a suspected exploit on January 8 involving a Truebit-linked contract, triggering a sharp collapse in TRU’s price. The suspicious activity centers around an 8,535 ETH transaction, roughly valued at $26 million using ETH’s price at $3,100. Truebit’s TRU token fell 99.95% in one day, prompting market desks to reassess counterparty risk.
$26M ETH Outflow Tied to Truebit Purchase Contract
Cyvers monitoring tools flagged the Ethereum address 0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2 as a “Truebit Protocol: Purchase” label. Etherscan also tags the address as a Truebit contract, raising concerns across multiple trading venues. The address appears to have interacted with 8,535 ETH, or around $26 million in digital assets.
This flagged address triggered questions around the status of treasury ETH or a compromised wallet. Market participants are unsure if the ETH was lost through a mispriced path, a treasury drain, or exploit activity. Cyvers has yet to confirm the wallet’s control structure or whether it was Truebit-linked.
Truebit’s documentation previously stated, “All sales transact in ETH,” which intensifies focus on this labeled path. Market makers and desks treating that contract as part of a trusted flow face increased operational risk. The sudden drop in TRU’s price further complicates the situation.
TRU Token Prints -99.95% Move, Questions Emerge Over Liquidity
On-chain pricing for the TRU token posted a 99.95% daily drop, with one token tracker showing $0.00007923 as the latest price. CoinGecko listed TRU at $0.1611 (+4.1%) just before the collapse, suggesting an abrupt and isolated event. This type of move typically points to DEX liquidity collapse or a broken price feed.
Price data anomalies of this scale are uncommon without liquidity events. As a result, desks have started investigating whether the collapse was triggered by internal mechanics or an external attack. Liquidity providers are expected to pause or widen spreads until clarity is established.
Truebit lists its TRU token at 0xf65B5C5104c4faFD4b709d9D60a185eAE063276c, making accurate mapping essential. Confusion has long existed between Truebit (TRU) and TrueFi (TRU), which share the same ticker symbol. Several desks have previously flagged execution and risk errors stemming from this collision.
Symbol Collision with TrueFi Adds Operational Complexity
The token ticker “TRU” has historically caused friction due to overlap between Truebit and TrueFi. This incident has reactivated concerns around system mappings that rely solely on ticker labels. In high-volume environments, this mapping issue introduces unnecessary counterparty and execution risk.
Automated systems parsing token movements based only on ticker are especially vulnerable. Truebit and TrueFi both maintain separate contract addresses, but symbol-only systems fail to distinguish between them. As a result, several venues may unknowingly list or trade incorrect assets.
In this case, the flagged address’s label included “purchase,” which could imply an official sale contract. However, without verified signers or confirmation from the Truebit team, the origin and intent of the ETH flow remain unclear. Trading desks are prioritizing review of label attribution and transactional context.


