DeFi protocol exploit drains $5.9M in assets

TLDR

A security exploit hit DeFi liquidity provider TrustedVolumes, draining roughly $5.9 million to $6.7 million in assets from its Ethereum resolver contract.

1. Hackers abused a bug in TrustedVolumes' custom RFQ swap proxy, stealing WETH, WBTC, USDC, and USDT from pre?approved funds.
2. The attacker is reportedly the same actor behind a 2025 1inch Fusion exploit, but 1inch says its own protocols and user funds were not affected.
3. DeFi users with approvals to the affected contracts should monitor revocation guidance and the broader rise in infrastructure?layer exploits.

Deep Dive

1. What Was Exploited

TrustedVolumes, a market maker and liquidity resolver used by multiple DeFi protocols, confirmed that an attacker drained about $5.87 million to $6.7 million via its Ethereum resolver contract, stealing around 1,291 WETH, 16.9 WBTC, 1.26 million USDC, and 206,000 USDT from a custom RFQ swap proxy.

Security firm Blockaid and others report that the exploit came from a flaw in TrustedVolumes' own swap infrastructure, not a standard user swap path, letting the attacker forge or authorize trades against pre?approved liquidity.

Researchers say the root cause involved "permissionless signer registration, broken replay protection, and an unvalidated transfer source field," allowing the attacker to register as a trusted signer and then drain funds without proper authorization, as detailed in coverage of the TrustedVolumes exploit.

2. Who Is Affected

TrustedVolumes said the stolen funds now sit across three Ethereum addresses holding roughly 3 million dollars, 3 million dollars, and 700,000 dollars each, and that it is open to a bug?bounty style resolution with the attacker, according to its statement summarized in Cointelegraph's report.

The incident primarily affects liquidity that was routed through TrustedVolumes' resolver and RFQ proxy, rather than all users of any single protocol.

DeFi aggregator 1inch has emphasized that its core protocols, infrastructure, and user funds were not directly compromised, calling reports that frame this as a 1inch hack "misleading" and stressing that TrustedVolumes is an independent service provider.

3. What To Watch Next

Blockaid and other security teams have linked this attacker to the March 2025 1inch Fusion V1 resolver exploit, suggesting a patient, specialized actor repeatedly targeting similar contract patterns, as described in follow?up coverage.

Several outlets note that DeFi has already seen hundreds of millions of dollars lost in recent weeks across exploits such as Drift Protocol and Kelp DAO, highlighting a broader wave of infrastructure?level failures.

Users who interacted with TrustedVolumes or related RFQ contracts should track any official guidance on revoking approvals and watch for on?chain notices or protocol posts about migration, compensation plans, or further security hardening.

Conclusion

The TrustedVolumes exploit is another example of how a single bug in a specialized infrastructure contract can drain millions even when headline protocols claim no direct breach. For DeFi users, the key takeaway is that approvals to resolvers, market makers, and custom proxies deserve the same scrutiny as approvals to main protocol contracts, and that monitoring security advisories and revoking unnecessary approvals is increasingly critical in a landscape of sophisticated, repeat attackers.