What happened
On January 8, 2026, Truebit — a verification protocol on Ethereum — was drained of $26.4M. The proceeds were consolidated into a single attacker-controlled wallet and then aggressively fragmented, and ChainHint's trace follows them to where they came to rest: DeFi swaps, a single exchange deposit address, and a larger group whose labels this page does not stand behind. Those labels are unverified and record no source, so the page names the endpoints and leaves them unnamed.
How the funds moved
Initial Extraction
$26.4M drained into a single attacker wallet, then immediately split across intermediary addresses to fragment the trail before analysts could react.
Swaps and Onward Transfers
Tranches were swapped through DeFi protocols, which breaks token-level continuity on its own. A second, larger group of addresses carries labels this page cannot publish: every one is unverified and none records where it came from.
Endpoint Fan-out
Endpoints run from DeFi positions to unattributed and scam-flagged addresses. The largest group — 40 of them — carries labels of a kind that records a counterparty rather than an identity, every one unverified and none recording its source, so this page does not repeat what they say. A single exchange deposit is the only custodial touchpoint.
Where the funds went
Read from the transfers in ChainHint's trace, not from press reports
ChainHint's trace of the Truebit hack follows 705 transfers across 112 addresses and 6 hops, between Jan 7, 2026 and Oct 10, 2026. The first hop out of the attacker's address moved ETH ($27M).
Visualized attack path
112 addresses · 705 transfers · Traced with ChainHint
Key findings
Source Wallet
Route of the Proceeds
Endpoint Map
Investigate your own incident
ChainHint traced the Truebit hack in minutes.
Use the same tool for your case.