
The TRUST staking vault exploit on Base drained 85M tokens via an ERC-4626 logic flaw. Team pauses vault, announces full user refunds.
Author: Kritika Gupta
Steady attention without excessive speculation.
16th March 2026- The TRUST staking vault exploit on the Base blockchain shocked DeFi users on March 14, 2026, after an attacker withdrew approximately 85.4 million $TRUST tokens through a smart contract logic flaw. Project founder @DegenApe99 confirmed the breach shortly after the incident. On chain data shows that the attacker first accumulated around 3 million $TRUST tokens before executing a rapid series of transactions designed to amplify staking rewards and enable repeated withdrawals.
Despite the large token amount drained, the attacker realized only about $16,000 in real market value because $TRUST had recently declined in price. Nevertheless, the exploit triggered a sharp loss of confidence across the ecosystem.
High Signal Summary For A Quick Glance
chosta.eth
@chosta_eth
@DegenApe99 @ivaavimusic Maaan, that’s so sad. The one token I kept to support building and then this. You guys do not deserve it but I’m sure that karma will reward the good and punish the bad
After 14 months of running, the $TRUST stake contract got exploited today. 88M was drained from the pool. @ivaavimusic did a UI update yesterday, not sure if it caused the issue or if other factors were involved. I'll have to wait until he wakes up to investigate. The exploiter https://t.co/7myrDCANrK
05:41 AM·Mar 15, 2026
Degen Ape Trader
@DegenApe99
This is purely staking contract pool, a logic exploited. Not user 's wallet exploited
After 14 months of running, the $TRUST stake contract got exploited today. 88M was drained from the pool. @ivaavimusic did a UI update yesterday, not sure if it caused the issue or if other factors were involved. I'll have to wait until he wakes up to investigate. The exploiter https://t.co/7myrDCANrK
03:13 AM·Mar 15, 2026
The exploit originated from a structural mismatch in the TRUST vault’s smart contract design. The system allowed users to lock deposits for up to 12 months in exchange for boosted staking shares. For example, the longest lock period minted sTRUST shares at a 25 to 1 ratio while also issuing 1 to 1 principal receipts in TRUST tokens.
However, the vault contract still retained standard ERC 4626 functions. These inherited functions remained fully accessible and bypassed the project’s custom withdrawal logic. Therefore, users could technically withdraw funds through the generic withdraw function instead of using the intended position specific mechanism. Although the team initially suspected a user interface update released one day earlier, investigators later confirmed that the vulnerability existed entirely on chain since deployment.
Importantly, this marked the first security incident in the TRUST staking system’s 14 month operational history. The contract had previously passed an independent audit and handled a peak total value locked of around $1.5 million without reported issues.
The attacker began executing the exploit at approximately 21:54 UTC on March 14. First, they called the createPosition function to deposit tokens and mint boosted sTRUST shares. Immediately afterward, they invoked the inherited withdrawal function to extract a larger token amount than originally deposited. By repeating this loop across multiple transactions, the attacker compounded gains quickly.
Transaction records show that staking amounts escalated from roughly 3 million to more than 36 million $TRUST in successive steps. In total, the attacker deposited about 110.9 million tokens while withdrawing approximately 196.4 million tokens. As a result, the vault became significantly undercollateralized before the team paused operations.
Following the TRUST staking vault exploit, the development team paused the vault through transaction 0xc30cdcfd284489541f493bc558e3c3a1cf0b2c10ff6d05b9d0af2be4ad7e61d.They secured the remaining funds and conducted a full on chain reconstruction of events. In a comprehensive postmortem published on March 16, the Trust Me Bros team committed to transparency and confirmed that all affected wallets will receive refunds.
Specifically, users will recover their original $TRUST principal along with accrued staking yield based on an upcoming snapshot. The team expects to complete refunds within the week. Meanwhile, the founder issued a public apology and indicated that this incident may discourage him from deploying future smart contracts.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
TRUST Staking Vault Exploit Drains 85M Tokens on Base
Venus Protocol Exploit Triggers Bad Debt After Token Manipulation
Morphware AI Scam Allegations Surface After $XMW Rug Pull Allegations
Bonk.fun Domain Hack Sparks Phishing Scam and Major Losses
TRUST Staking Vault Exploit Drains 85M Tokens on Base
Venus Protocol Exploit Triggers Bad Debt After Token Manipulation
Morphware AI Scam Allegations Surface After $XMW Rug Pull Allegations
Bonk.fun Domain Hack Sparks Phishing Scam and Major Losses