Q1–Q2 2026 Mint and Tokenomics Exploit Cohort — Truebit, Saga, SolvBTC, FOOM Cash, TMX TRIBE — Aggregate ~$40.1M

Summary

Timeline

When	Event	OAK ref
2017 (deploy)	Truebit Purchase proxy contract deployed on Ethereum; bonding-curve mechanism for TRU token; contract left unverified on Etherscan for ~5 years; banteg flags it as a "rug zone" in 2021 — warning not actioned	(standing T9.004 + T9.011 surface)
2026-01-08	Truebit: attacker calls Attack() (literal function name in the transaction calldata) on the unverified bonding-curve contract; drains 8,535 ETH (~$26.4M) in a single sweep	T9.011 (bonding-curve arithmetic exploit), T9.004 (unverified contract — no community review)
2026-01-21	Saga: attacker crafts custom IBC messages to the SagaEVM precompile bridge; protocol mints ~$7M in Saga Dollar from "pure imagination" — no collateral, no validation; attacker redeems for real assets (yETH, yUSD, tBTC), bridges to Ethereum	T5.003 (infinite mint via forged cross-chain message), T9.004 (missing IBC-message validation)
2026-01-21	Saga pauses SagaEVM at block height 6593800; attacker has already converted minted $D to 2,000+ ETH and exited	(protocol response — too late)
2026-03-02	FOOM Cash: attacker spams fake proofs to the proof-verification entrypoint; contract accepts forged proofs and mints tokens without authorisation; ~$2.26M extracted across Ethereum and Base	T9.004 (proof-verification bypass — missing proof validation), T5.003 (unauthorised mint)
2026-03-06	SolvBTC: mint-reserves logic exploit on Ethereum; attacker manipulates the reserve-accounting path to mint unbacked tokens; ~$2.7M extracted	T9.004 (reserve-accounting logic gap), T5.003 (unbacked mint)
2026-01-05	TMX TRIBE: mint-and-stake loop exploit on Arbitrum; attacker exploits an unbounded loop between minting and staking rewards; ~$1.4M extracted	T9.004 (unbounded loop multiplier), T5.003 (mint-and-stake amplification)

Truebit — Five-Year Bonding-Curve Time Capsule

On January 8, 2026, an attacker drained 8,535 ETH (~$26.4M) from Truebit's Purchase proxy contract in a single transaction. The contract — deployed ~2017 — had sat on Ethereum for nearly five years as unverified bytecode with no published audits. banteg had flagged the bonding curve as a "rug zone" in 2021; the warning was not actioned. The attacker's transaction was labelled with a function literally named Attack() in the calldata — a detail that became the exploit's dark punchline.

The bonding-curve mechanism computed a TRU token price based on the pool's ETH balance. The attacker exploited the integer-arithmetic pricing formula — a variant of T9.011 (Precision-Loss Rounding Attack) applied to a bonding-curve rather than a vault — to extract the pool's entire ETH balance. The contract's unverified status meant that no community reviewer, auditor, or security researcher had inspected the bonding-curve arithmetic in half a decade.

Cyvers caught the drain first; TheDeFiDan spotted the Attack() function name three minutes later. Security researchers (William Li, BlockScope, AstraSec, Hacken) confirmed the exploit was against a "very old contract deployed ~5 years ago" — the incident is the canonical 2026 case of a long-dormant unverified contract becoming a ticking bomb when the bonding-curve math is finally exploited.

Saga — Forged IBC Precompile Infinite Mint

On January 21, 2026, an attacker crafted custom IBC (Inter-Blockchain Communication) messages sent to the SagaEVM precompile bridge on the Saga chainlet. The precompile trusted the IBC message payload without validation — the attacker "whispered custom IBC messages into the precompile's ear, and the protocol believed every word, minting $7 million worth of Saga Dollar from pure imagination." No collateral was posted. No validation was performed.

The attacker redeemed the freshly printed stablecoins ($D) for real assets — yETH, yUSD, tBTC — then bridged the loot to Ethereum and converted it to 2,000+ ETH before Saga paused the chainlet at block height 6593800.

The root cause was a missing IBC-message validation check in the precompile bridge logic: the contract bypassed validation for custom IBC messages or payloads, enabling infinite minting of $D tokens without collateral. The incident is the canonical 2026 case of a cross-chain-message-forgery infinite mint — a T5.003 variant where the mint-authorisation bypass is at the cross-chain messaging layer rather than within a single-chain smart contract.

FOOM Cash — Fake-Proof Spam Mint

On March 2, 2026, FOOM Cash on Ethereum and Base was exploited for ~$2.26M via fake-proof spam. The attacker submitted forged proofs to the protocol's proof-verification entrypoint; the contract accepted the forged proofs and minted tokens without authorisation. The multi-chain surface (Ethereum + Base) suggests the proof-verification gap was in the shared contract logic rather than a chain-specific vulnerability.

SolvBTC — Mint-Reserves Accounting Logic Exploit

On March 6, 2026, SolvBTC on Ethereum was exploited for ~$2.7M via a mint-reserves logic exploit. The attacker manipulated the reserve-accounting path to mint unbacked tokens — the protocol's mint function trusted the reserve-accounting state without verifying that the minted amount was collateralised. The incident is structurally similar to the Resolv Labs USR unlimited-mint case (March 2026, T11.001 + T5.003) but distinct in that the SolvBTC vector was a reserve-accounting logic gap rather than a key compromise.

TMX TRIBE — Mint-and-Stake Loop Amplification

On January 5, 2026, TMX TRIBE on Arbitrum was exploited for ~$1.4M via a mint-and-stake loop exploit. The attacker exploited an unbounded loop between the protocol's mint function and staking-reward mechanism — minting tokens, staking them for rewards, using the rewards to justify further minting, and repeating in a cycle that amplified the extraction with each iteration.

Public references

• Truebit — Rekt — primary forensic narrative: 5-year-old unverified bonding curve, Attack() function name, banteg 2021 warning
• Saga — Rekt — primary forensic narrative: forged IBC precompile messages, infinite $D mint, cross-chain exit
• Cyvers, TheDeFiDan, William Li, BlockScope — Truebit first responders
• CertiK, GoPlusSecurity — Saga first responders
• FOOM Cash, SolvBTC, TMX TRIBE: DeFiLlama classifications
• Cross-reference: T5.003 at techniques/T5.003-infinite-mint-attack.md; T9.004 at techniques/T9.004-access-control-misconfiguration.md; T9.011 at techniques/T9.011-precision-loss-rounding-attack.md

Discussion

The Q1–Q2 2026 mint-and-tokenomics exploit cohort reveals a structural pattern: mint functions are access-control surfaces, and the access-control check is often embedded in a validation step (IBC message verification, proof verification, reserve-accounting collateralisation check, loop-iteration bound) that the protocol treats as an accounting detail rather than a security boundary. When the validation step fails — a forged IBC message passes, a fake proof is accepted, a reserve invariant is unchecked — the mint function produces unbacked tokens that are then redeemed against real assets.

The Truebit case is the cohort's most striking illustration of security decay over time: a contract deployed in 2017, flagged as dangerous in 2021, and exploited in 2026. The five-year gap between deployment and exploit is not a testament to the contract's security — it is a testament to the obscurity of unverified bytecode. The moment an attacker read the bytecode and understood the bonding-curve math, the exploit was inevitable. The Attack() function name is the incident's signature detail — the attacker was not hiding; the contract was.

Saga's IBC-precompile exploit demonstrates that cross-chain messaging layers multiply the mint-authorisation surface: a single-chain mint function has one authorisation path to secure; a cross-chain mint function has every chain's message-validation path as a potential entry point. The forged IBC messages exploited a trust assumption — "the precompile receives valid IBC messages" — that the SagaEVM bridge had not validated internally.

The FOOM Cash, SolvBTC, and TMX TRIBE cases round out the cohort with three variants of the same structural pattern: the protocol's mint-authorisation logic trusted an input (proof, reserve state, loop counter) that the attacker could control. The defender lesson is that every input to a mint function is an access-control checkpoint — if the input can be forged, spoofed, replayed, or amplified, the mint function is a T9.004 surface regardless of what other security measures the protocol has in place.