TrustedVolumes has officially confirmed it was hacked for approximately $6.7 million through a custom request-for-quote (RFQ) swap proxy under its control. According to the company's X post, the stolen funds are currently distributed across three addresses holding $3 million, $3 million, and $700,000 in assets respectively. The exploit targeted infrastructure connected to 1inch without compromising end users directly, similar to the March 2025 1inch Fusion v1 hack against the same market maker. Blockchain security company Blockaid reports that approximately $5.87 million was drained from TrustedVolumes' Ethereum resolver contract, including 1,291.16 WETH, 206,282 USDT, 16.939 WBTC, and 1,268,771 USDC.
Security experts have identified the root cause as a combination of permissionless signer registration, broken replay protection, and an unvalidated transfer source field. As reported by Decrypt, Hakan Unal, senior security operations lead at crypto security firm Cyvers, explained that these flaws allowed the attacker to act as a trusted signer and drain victims without valid authorization. The exploiter routed funds through high-risk no-KYC exchange ChangeNow before converting to ETH. The attack targeted a custom RFQ swap proxy controlled by TrustedVolumes rather than standard 1inch aggregation routes, with the exploiter address appearing linked to the same actor behind the March 2025 1inch Fusion v1 hack.
1inch has emphasized that its core aggregation contracts were not affected, with the vulnerability lying in TrustedVolumes' custom RFQ proxy design. According to Decrypt reporting, a 1inch spokesperson confirmed there is no impact on 1inch systems, infrastructure or user funds. The company stressed that its standard routes remain secure and that built-in redundancy functioned exactly as intended, with other providers continuing to serve users without disruption when one becomes unavailable. 1inch co-founder Sergej Kunz pushed back against reports linking the platform directly to the breach, framing it as an attack on the protocol itself rather than on 1inch itself.
Security experts warn the damage could have been far greater than the actual $6.7 million loss. As reported by Decrypt, Hakan Unal noted that with replay protection nonfunctional, the attacker could have potentially drained additional approved accounts repeatedly. The exploit demonstrates how sophisticated actors increasingly target custom proxies and privileged contracts behind familiar DeFi front ends, exploiting complexity that most retail traders never see. This incident follows a pattern where teams attempt to convert live exploits into "white hat" events by dangling bug bounties and informal immunity, with previous cases showing negotiations often lead to most funds being returned after exploit identification.
TrustedVolumes is offering to engage in "constructive communication" with the attacker over a vulnerability bounty and potential fund return. As reported by crypto.news, this mirrors a familiar pattern in DeFi where teams attempt to convert live exploits into "white hat" events by dangling bug bounties and informal immunity. The company has stated it is "open to constructive communication regarding a bug bounty and a mutually acceptable resolution," with previous cases showing negotiations often lead to most funds being returned after exploit identification. 1inch has emphasized it is working alongside security partners to understand the exploit specifics and will incorporate relevant findings into ongoing security processes.
