Truebit Protocol loses $26 million in Solidity 0.6.10 overflow exploit tied to SafeMath omission

On January 12, 2026, SlowMist released an audit report on the Truebit Protocol exploit that drained about $26 million in ETH. The report attributes the incident to an unchecked addition operation in the Purchase contract's price calculation, compiled with Solidity 0.6.10 without SafeMath overflow protection. The attack briefly pushed Uniswap's daily trading fee capture revenue above $1.4 million, largely driven by TRU-related trading.