1inch

Bounty

2026

Proxy

The party responsible for the TrustedVolumes exploit has returned 1,122 ETH, worth roughly $2 million at current prices. On-chain monitoring identified the transfer as a partial repayment linked to the May 7, 2026 incident. The repayment marks the latest development in the original <a href="https://cryip.co/trustedvolumes-exploited-5-87-million-1inch-resolver-same-attacker/" rel="noopener noreferrer nofollow">TrustedVolumes exploit</a>, in which the stolen assets were converted into approximately 2,513 ETH. TrustedVolumes reported a total loss of approximately $6.7 million. Initial security estimates valued the drain at about $5.87 million, comprising 1,291.16 WETH, 206,282 USDT, 16.939 WBTC and roughly 1.27 million USDC taken from the project’s inventory. 
<blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/26a0.png" alt="⚠" style="height: 1em; max-height: 1em;"> JUST IN: The TrustedVolumes exploiter has returned 1,122 ETH ($2M+
 The original exploit resulted in more than $5.8M being stolen. The exploiter has now returned around $2M while retaining another $2M as a “bounty” <a href="https://t.co/HJSdx4i4Or" rel="noopener noreferrer nofollow">pic.twitter.com/HJSdx4i4Or</a>
 — Com Feed (@thecomfeed) <a href="https://x.com/thecomfeed/status/2078336646466945374?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 18, 2026</a>
</blockquote>
The return followed a settlement message requesting exactly 1,122 ETH.
<ul>
 <li>Return address:<a href="https://etherscan.io/address/0xb6f28ed0f919a12822fe78f6d610e5e09a6fe450" rel="noopener noreferrer nofollow"> 0xb6f28ed0f919a12822fe78f6d610e5e09a6fe450</a></li>
 <li>Primary attacker-associated address:<a href="https://etherscan.io/address/0xC3EBDdEa4f69df717a8f5c89e7cF20C1c0389100" rel="noopener noreferrer nofollow">0xC3EBDdEa4f69df717a8f5c89e7cF20C1c0389100</a></li>
</ul>
The attacker retained funds of comparable value and described the remaining portion as a bounty. TrustedVolumes has not published the complete settlement terms or directly confirmed the final bounty amount. After the exploit, the project said it was open to constructive communication over a vulnerability bounty and a mutually acceptable resolution.
Bounty offers are also used in other crypto recovery efforts, including the <a href="https://cryip.co/bc-game-hack-500000-bounty-announced-after-4-3-million-crypto-exploit/" rel="noopener noreferrer nofollow">BC.GAME hack</a>, where the platform offered $500,000 for credible information identifying the attacker. Unlike recoveries where security researchers receive a formally approved reward, such as the <a href="https://cryip.co/foom-cash-recovery-white-hat-experts-secure-1-84m-following-smart-contract-exploit/" rel="noopener noreferrer nofollow">$1.84 million Foom.cash rescue</a>, the amount retained in this case has only been labelled a bounty by the attacker.
<h2 id="custom-rfq-proxy-enabled-the-exploit">Custom RFQ Proxy Enabled the Exploit</h2>
Security researchers attributed the incident to TrustedVolumes’ custom request-for-quote swap proxy. Access-control and authorization weaknesses allowed the attacker to register an approved order signer and submit malicious orders against the project’s inventory.
The contract checked authorization using the order’s receiver field but transferred tokens from the inventory address. Researchers also identified ineffective replay protection. Together, the flaws enabled the attacker to drain multiple assets in a single transaction.
<h2 id="1inch-systems-were-not-affected">1inch Systems Were Not Affected</h2>
The vulnerable RFQ proxy and inventory contracts were controlled by TrustedVolumes. They were not part of 1inch’s core aggregation infrastructure. 1inch said its protocols, systems and user funds were unaffected. The incident targeted TrustedVolumes’ independent market-making setup rather than ordinary swaps made through 1inch. The 1,122 ETH transfer confirms a partial recovery from the May exploit. However, TrustedVolumes has not publicly disclosed how the retained amount was calculated or whether it considers the settlement complete.

TrustedVolumes Attacker Returns 1,122 ETH, Retains Funds After Settlement

Table of Contents

CRYIP

Other articles published on Jul 18, 2026

Join our free newsletter for daily crypto updates!