DeFi Disasters: $5.87M Vanishes in a Poof of Code!

by

Oh, what a to-do in the land of DeFi! TrustedVolumes, that trusty old liquidity provider, has been turned upside down like a pocket with a hole, spilling out a cool $5.87 million in digital treasure!

The world of decentralized finance, that wild and woolly frontier, has been struck yet again by the mischievous hands of cyber scallywags. Another exploit, as bold as brass, has hit the infrastructure linked to the 1inch exchange aggregator. It’s like a game of whack-a-mole, but the moles are stealing millions! Security boffins have pointed their magnifying glasses at a familiar rogue, one who’s been up to no good in earlier DeFi capers this year. The losses are piling up faster than a giant’s laundry, and confidence in resolver contracts is as shaky as a three-legged stool.

Blockaid Sounds the Alarm: TrustedVolumes Under Siege!

The clever clogs at blockchain security firm Blockaid (yes, they’re the ones with the fancy gadgets) reported on Wednesday that TrustedVolumes had been given a proper seeing-to. Attackers, those sneaky rascals, drained around $5.87 million in digital goodies from its resolver contract on the Ethereum network. But wait, there’s more! The losses later ballooned to nearly $6.7 million. Greedy lot, aren’t they?

Blockaid’s exploit detection system has identified an on-going exploit on TrustedVolumes (1inch market maker / resolver). Chain: Ethereum

Victim contract: TrustedVolumes resolver – 0x9bA0CF1588E1DFA905eC948F7FE5104dD40EDa31

Exploiter:…

– Blockaid (@blockaid_)

The swag included 1,291.16 wrapped ether, 206,282 tether, 16.939 wrapped bitcoin, and a whopping 1.26 million USDC. Blockaid reckons the exploit was all down to a vulnerability tied to a TrustedVolumes-controlled request-for-quote swap proxy. Fancy words for a fancy heist!

And here’s the kicker: the same scoundrel was linked to the March 2025 exploit against 1inch Fusion V1, which nicked about $5 million. But don’t be fooled-this latest caper used a different trick up its sleeve. Crafty, aren’t they?

1inch Says, “Not Our Circus, Not Our Monkeys!”

TrustedVolumes, poor dears, confirmed the incident and muttered something about a bug bounty to sort out the mess. No word yet on how they’ll get their treasure back. Meanwhile, 1inch chimed in with a cheery, “Nothing to see here, folks!” They claim their infrastructure, user funds, and internal systems are as safe as houses. According to them, TrustedVolumes is an independent sort, working with all sorts of protocols across the industry.

DeFi Platforms in a Tizzy as Losses Hit $750M

Security breaches in decentralized finance have been popping up like weeds in a garden. Data from DefiLlama (yes, that’s a real thing) shows that hackers made off with a staggering $750 million in April alone. That’s the biggest monthly loss since the Bybit hack in February 2025, which saw nearly $1.5 billion vanish into thin air. Blimey!

TrustedVolumes is just the latest in a string of five major exploits since the start of May. Earlier this week, Ekubo Protocol lost around $1.4 million in wrapped Bitcoin after attackers exploited an access-control vulnerability in their swap router contracts. Blockaid says the exploit targeted a vulnerable payment callback mechanism tied to Ekubo’s EVM extension contracts. Sounds like a right old mess!

All these attacks are shining a spotlight on resolver contracts and custom approval systems. Fast trade execution often means handing out elevated permissions like sweets at a party. But when vulnerabilities pop up or attackers get their mitts on trusted access, it’s like leaving the back door wide open for the local ne’er-do-wells.

Read More

2026-05-07 12:24