TrustedVolumes $6.7M Exploit on Ethereum Resolver

TrustedVolumes, a liquidity provider and market maker used by multiple DeFi protocols including 1inch, suffered an exploit on its Ethereum resolver contract that drained approximately 6.7 million in cryptocurrency on May 7, 2026.

Blockchain security firms Blockaid and PeckShield identified the attack, which initially extracted about 5.87 million before rising to 6.7 million. The stolen assets included 1,291 wrapped ether (WETH), 206,282 Tether (USDT), 16.93 wrapped bitcoin (WBTC) and 1.26 million USD Coin (USDC). TrustedVolumes confirmed the breach on X, disclosing three Ethereum wallet addresses holding the funds: two with roughly 3 million each and one with about 700,000. The firm stated it was "open to constructive communication regarding a bug bounty and a mutually acceptable resolution."

Experts attributed the exploit to vulnerabilities in a TrustedVolumes-controlled custom request-for-quote (RFQ) swap proxy. Hakan Unal, senior security operations lead at Cyvers, explained the root cause as permissionless signer registration, broken replay protection and an unvalidated transfer source field. These flaws allowed the attacker to impersonate a trusted signer and drain...