A TrustedVolumes attacker has returned 1,122 ETH worth approximately $2 million while retaining another $2 million as a self-declared bounty following the May exploit. According to Com Feed monitoring, the Ethereum transfer represents a partial recovery from the initial attack that drained about $5.87 million from a contract controlled by the liquidity provider. At the time of writing, TrustedVolumes had not formally confirmed that it had accepted the attacker's bounty terms, as reported by Com Feed.
TrustedVolumes disclosed in May that the total loss had reached roughly $6.7 million, exceeding the initial estimate reported by security researchers. The company said at that time the stolen assets were held across three addresses containing approximately $3 million, $3 million, and $700,000. Before the stolen tokens were consolidated, Blockaid identified 1,291.16 WETH, 206,282 USDT, 16.939 WBTC, and 1.27 million USDC among the drained assets. PeckShield later reported that the attacker exchanged the tokens and gathered the proceeds into about 2,513 ETH.
As previously reported by crypto.news, Blockaid traced the May 7 attack to a custom request-for-quote swap proxy operated by TrustedVolumes. According to the security firm, the attacker targeted the company's Ethereum resolver setup rather than a regular 1inch swap route. Verichains found that a public function lacked access controls, allowing the attacker to register an address as an approved order signer and create transactions that appeared valid to the proxy. During the same transaction, the attacker directed the proxy to pull WETH, WBTC, USDT, and USDC from the TrustedVolumes inventory vault.
Although the affected market maker supplied liquidity through 1inch, the attack did not compromise 1inch's core aggregation contracts or standard user routes, according to 1inch's account of the incident. Blockaid linked the wallet to the March 2025 Fusion V1 exploit but reported that the May attack used a different flaw tied to TrustedVolumes' custom proxy. The combined dollar value of the returned and retained funds is lower than the original loss because ETH has fallen since the May exploit, when the stolen assets were converted into the cryptocurrency.
