An attacker exploited missing access control in TrustedVolumes' RFQ swap proxy to add themselves to the order signer allowlist, forge trade orders, and drain funds across 85 transactions in WETH, WBTC, USDT, and USDC.

TrustedVolumes, a key liquidity provider and resolver (market maker) for 1inch Fusion and other DeFi protocols, was exploited via a vulnerability in its custom RFQ swap proxy contract, resulting in approximately $6.7 million stolen. The project confirmed the incident on X, published the three Ethereum addresses holding the stolen funds (approx. $3M, $3M, and $700K), and stated openness to constructive communication for a bug bounty and mutually acceptable resolution. 1inch confirmed its protocol, infrastructure, and user funds are unaffected.In July 2026, the attacker returned ~1,122 ETH (~$2M) while keeping a similar amount as bounty.