TrustedVolumes loses $5.87M after custom RFQ proxy lets attacker drain inventory
rekt.news •
Revision history
4 recorded changes
Want your article here?
Promote with Leviathan NewsTrustedVolumes, a liquidity provider and resolver in 1inch's Fusion ecosystem, was drained on Ethereum on May 7 through a custom RFQ proxy that confused signer validation with actual authorization. The attacker used a permissionless signer registration path, a check against the wrong address, and broken replay protection to pull 1,291 WETH, 206,282 USDT, 16.94 WBTC, and 1.27M USDC in one transaction. The on-chain loss priced around $5.87M, while TrustedVolumes' own post-exploit accounting put it closer to $6.7M.
TLDR by @Benthic
More coverage
- TrustedVolumes Exploit Drains $5.87M From 1inch ... - Our Crypto Talk (ourcryptotalk.com)
- TrustedVolumes $5.87M RFQ Exploit (Explained) - QuillAudits (quillaudits.com)
- TrustedVolumes RFQ Proxy Drain | DARKNAVY (darknavy.org)
- $5.87M Ethereum Exploit Hits TrustedVolumes as 1inch Denies Any ... (cryptoninjas.net)
- Weekly Incident Report: May 4–10, 2026 - Recoveris (recoveris.io)
