Happy

Flow

Wrapped Bitcoin

Request

USDC

<h3 id="what-to-know">What to know:</h3>
<ul>
 <li>Hackers drained millions after exploiting TrustedVolumes signature verification vulnerability.</li>
 <li>SlowMist revealed that attackers quickly laundered stolen Ethereum, Bitcoin, and stablecoin holdings.</li>
 <li>TrustedVolumes exploit raises renewed concerns surrounding decentralized finance security standards.</li>
</ul>
Another security failure has struck the decentralized finance industry after attackers exploited a vulnerability inside TrustedVolumes, a liquidity provider operating within the 1inch ecosystem. Blockchain investigators quickly detected unusual fund movements after millions of dollars vanished from wallets connected to the protocol. 
<a href="https://x.com/SlowMist_Team/status/2052227002980253715" rel="noopener noreferrer nofollow">According to blockchain security firm SlowMist</a>, the exploit allowed hackers to drain nearly $5.9 million in Ethereum (ETH), Wrapped Bitcoin (WBTC), USD Coin (USDC), and Tether (USDT). The attack reportedly targeted a weakness tied directly to the protocol’s signature validation system. 
Moreover, the exploit intensified concerns surrounding decentralized trading platforms that rely heavily on smart contract approvals and cryptographic verification. Since TrustedVolumes operates using a Request for Quote structure, traders and liquidity providers must sign transactions before execution. Consequently, any flaw involving signature verification creates a serious security threat. 
SlowMist’s findings showed the attacker stole approximately 1,291 ETH valued at over $3 million. Additionally, the hacker secured 16.94 WBTC worth nearly $1.4 million alongside over $1.4 million combined in stablecoins. 
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨">SlowMist TI Alert<img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨"> 
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f4b8.png" alt="💸"> Loss: ~1,291.16 ETH + ~1,268,771 USDC + ~206,282 USDT + ~16.94 WBTC <a href="https://twitter.com/trustedvolumes?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@trustedvolumes</a> 
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f50d.png" alt="🔍"> Root Cause: In fillOrder function (selector 0x4112e1c2) of RFQ Implementation, signature validation checks _allowedSigners[msg.sender][signer] using caller (taker)… <a href="https://t.co/GbZJPrZyLc" rel="noopener noreferrer nofollow">pic.twitter.com/GbZJPrZyLc</a> 
 — SlowMist (@SlowMist_Team) <a href="https://twitter.com/SlowMist_Team/status/2052227002980253715?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 7, 2026</a> 
 </blockquote>
</div>
Also Read: <a href="https://36crypto.com/alert-a-major-diversion-just-happened-in-xrp-exchange-flow-behavior/" rel="noopener noreferrer nofollow">Alert: A Major Diversion Just Happened in XRP Exchange Flow Behavior</a> 
<h2 id="trustedvolumes-signature-flaw-triggered-massive-crypto-drain">TrustedVolumes Signature Flaw Triggered Massive Crypto Drain</h2>
Investigators revealed that the exploit originated from a logical weakness inside the protocol’s fillOrder function. The flaw reportedly enabled attackers to bypass authorization checks and forge trading instructions without obtaining legitimate approval from users. 
Besides exposing weaknesses inside TrustedVolumes, the incident also highlighted broader risks tied to RFQ-based decentralized trading systems. Unlike platforms such as Uniswap, RFQ protocols depend on direct agreements between makers and takers instead of liquidity pools. 
Consequently, secure signature verification becomes critical for preventing <a href="https://36crypto.com/north-korea-denies-crypto-hack-claims-as-577m-theft-sparks-global-alarm/" rel="noopener noreferrer nofollow">unauthorized order execution</a>. However, a single coding mistake inside core contract logic proved enough to compromise millions in user-linked assets within minutes. 
According to on-chain data shared by SlowMist, the attacker immediately began laundering the stolen assets after completing the exploit. Records showed the hacker routing stablecoins and Wrapped Bitcoin through decentralized exchanges shortly after draining the funds. 
Meanwhile, the latest exploit added further pressure on <a href="https://36crypto.com/what-is-decentralized-finance-defi-and-how-does-it-work/" rel="noopener noreferrer nofollow">decentralized finance</a> developers already facing rising criticism over recurring smart contract vulnerabilities. Several protocols across the industry have experienced similar attacks this year, particularly platforms handling liquidity routing and peer-to-peer settlement systems. 
The TrustedVolumes exploit has reinforced ongoing concerns surrounding smart contract security within decentralized finance infrastructure. Although DeFi platforms continue expanding globally, vulnerabilities involving authorization logic remain one of the sector’s most damaging operational risks. 
Also Read: <a href="https://36crypto.com/you-will-be-happy-in-5-years-time-why-does-ripple-ceo-keep-coming-back-to-this-when-talking-about-xrp/" rel="noopener noreferrer nofollow">‘You Will be Happy in 5-Year Time’ – Why Does Ripple CEO Keep Coming Back to This When Talking About XRP?</a> 
The post <a href="https://36crypto.com/hackers-exploit-trusted-volumes-bug-escape-with-5-9m-in-crypto-assets/" rel="noopener noreferrer nofollow">Hackers Exploit TrustedVolumes Bug, Escape With $5.9M in Crypto Assets</a> appeared first on <a href="https://36crypto.com" rel="noopener noreferrer nofollow">36Crypto</a>.

Hackers Exploit TrustedVolumes Bug, Escape With $5.9M in Crypto Assets

Table of Contents

36crypto

Other articles published on May 7, 2026

Join our free newsletter for daily crypto updates!