1inch

Order

DeFi

Fusion

Million

<p>Another major DeFi attack has shaken the crypto market. A liquidity provider tied to 1inch’s Trusted Volumes system has reportedly been exploited for nearly $5.87 million, with attackers draining millions in WETH, USDT, WBTC, and USDC.&nbsp;</p>
<p>What’s more shocking while is two of the 1inch Responded to the exploited, Denies Protocol Exploit Claims, says TrustedVolumes operates independently as a liquidity</p>
<h2 class="wp-block-heading" id="h-how-the-trusted-volumes-exploit-happened">How the Trusted Volumes Exploit Happened</h2>
<p>Security researchers at Blockaid revealed that attackers exploited a vulnerability in the Trusted Volumes resolver contract. This vulnerability allowed them to execute malicious orders directly from users’ wallets.</p>
<p>The attack worked by abusing a public function in the contract. Using this function, the attacker was able to add themselves as an “Allowed Order Signer.” Once they gained this permission, they could use old wallet approvals that users had previously granted to move funds.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>🚨 Blockaid's exploit detection system has identified an on-going exploit on TrustedVolumes (1inch market maker / resolver, <a href="https://twitter.com/trustedvolumes?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@trustedvolumes</a> ).<br>Chain: Ethereum<br><br>Victim contract: TrustedVolumes resolver — 0x9bA0CF1588E1DFA905eC948F7FE5104dD40EDa31<br><br>Exploiter:…</p>— Blockaid (@blockaid_) <a href="https://twitter.com/blockaid_/status/2052198320420819089?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 7, 2026</a>
  </blockquote>
 </div>
</figure>
<p>What made the exploit especially dangerous is that users did not need to approve any new transaction for the attack to happen. Existing token approvals alone were enough for attackers to access and transfer assets.</p>
<p>The incident once again highlights one of DeFi’s biggest hidden risks: unlimited token approvals that stay active even after users stop using a protocol.</p>
<p>According to Blockaid, the attacker behind this exploit appears to be linked to the March 2025 1inch Fusion V1 attack.</p>
<h2 class="wp-block-heading" id="h-nearly-5-9-million-drained"><strong>Nearly $5.9 Million Drained</strong></h2>
<p>Further blockchain security firm <a href="https://x.com/PeckShieldAlert/status/2052211288068198848" rel="noopener noreferrer nofollow">PeckShield</a> reported that the attacker has already extracted:</p>
<ul>
 <li>1,291.16 WETH</li>
 <li>206,282 USDT</li>
 <li>16.939 WBTC</li>
 <li>1,268,771 USDC</li>
</ul>
<p>The total stolen amount currently stands at approximately $5.87 million.</p>
<p>Researchers identified the affected resolver contract and vulnerable proxy linked to the March 2025 1inch Fusion V1 attack. Security experts also discovered strong similarities between the two incidents while tracing the exploiter wallet connected to the attack.</p>
<h2 class="wp-block-heading" id="h-defi-hacks-continue-to-rise-in-2026"><strong>DeFi Hacks Continue to Rise in 2026</strong></h2>
<p>The TrustedVolumes exploit is now reportedly the fifth major DeFi exploit over the last one month alone, extending what is becoming an increasingly dangerous period for decentralized finance platforms.</p>
<p>The overall DeFi market has already witnessed several massive hacks in recent weeks, including:</p>
<ul>
 <li>A reported $285 million <a href="https://coinpedia.org/news/solanas-drift-protocol-suffers-285m-exploit-drift-token-crashes/" rel="noopener noreferrer nofollow">exploit</a> targeting Drift Protocol</li>
 <li>A separate $293 million attack involving <a href="https://coinpedia.org/news/after-293m-kelpdao-exploit-analyst-says-best-outcome-is-a-10-to-15-bounty-deal-with-hacker/" rel="noopener noreferrer nofollow">Kelp DAO</a></li>
</ul>
<p>According to data from <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">DefiLlama</a>, total crypto assets stolen in April 2026 surged to approximately $635.2 million, the highest level since the massive 2025 Bybit exploit where nearly $1.5 billion was drained.</p>
<h2 class="wp-block-heading" id="1inch-responds-denies-protocol-exploit-claims">1inch Responds, Denies Protocol Exploit Claims</h2>
<p>Following reports linking the attack to 1inch, the protocol released an official statement denying that its own systems or infrastructure were compromised.</p>
<p>In a recent update, <a href="https://x.com/1inch/status/2052288374451339544" rel="noopener noreferrer nofollow">1inch stated</a>:</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>“We are aware of misleading reports relating to an exploit involving TrustedVolumes. We can confirm that neither 1inch nor any of the 1inch protocols are involved.”</p>
</blockquote>
<p>The team further clarified that there was “no impact on 1inch systems, infrastructure or user funds.”</p>
<p>According to the statement, TrustedVolumes operates independently as a liquidity provider and is used by multiple protocols across the DeFi industry, meaning the affected infrastructure was not exclusive to 1inch.</p>

1inch Denies Protocol Exploit After Trusted Volumes Attack Drains $5.87 Million

Table of Contents

CoinPedia News

Other articles published on May 7, 2026

Join our free newsletter for daily crypto updates!