{"id":"trustedvolumes-swap-proxy-theft-may-2026","category":"breach","status":"closed","title":"TrustedVolumes swap-proxy theft drains millions; about US$2 million reportedly returned","tldr":"An attacker drained TrustedVolumes’ crypto inventory through its Ethereum swap proxy. About US$2 million was reportedly returned in July; full recovery remains unconfirmed. If you have exposure through an investment manager, ask them to check it.","summary":"On 7 May, an attacker drained crypto assets from TrustedVolumes, a liquidity provider that supplies tokens for trades across decentralised finance services. Its custom Ethereum swap proxy failed to restrict who could authorise trades, allowing unauthorised orders to take its inventory. Researchers initially valued the stolen WETH, USDT, wrapped bitcoin and USDC at US$5.87 million; TrustedVolumes reported about US$6.7 million across three attacker addresses. These were separate reported valuations. TrustedVolumes sought discussions about returning the funds, while 1inch said its own protocols, infrastructure and user funds were unaffected. In July, crypto.news reported a partial return of 1,122 ETH, then worth about US$2 million, with a similar amount retained as a claimed bounty. As of 3 November, the reviewed sources do not establish full recovery, company acceptance of that bounty, or confirmed remediation of the affected proxy.","action":"There is no device or wallet-app update for this theft. If your family has funds with TrustedVolumes directly or through an investment manager, ask that provider to confirm your exposure, any loss and the recovery position.","product":"TrustedVolumes liquidity service and custom Ethereum RFQ swap proxy","audience":"work","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["trustedvolumes","crypto","ethereum","defi","crypto-theft","access-control"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"post","title":"TrustedVolumes exploit statement, reproduced by Cointelegraph; original X post could not be retrieved","url":"https://cointelegraph.com/news/1inch-fusion-resolver-trusted-volumes-floats-bounty-after-67m-exploit","by":"TrustedVolumes, via Cointelegraph","date":"2026-05-07"},{"kind":"news","title":"TrustedVolumes confirms $6.7 million exploit, seeks “constructive” talks with hacker","url":"https://crypto.news/trustedvolumes-confirms-6-7-million-exploit-seeks-constructive-talks-with-hacker/","by":"crypto.news","date":"2026-05-07"},{"kind":"research","title":"Explained: The TrustedVolumes Hack (May 2026)","url":"https://www.halborn.com/blog/post/explained-the-trustedvolumes-hack-may-2026","by":"Halborn","date":"2026-05-11"},{"kind":"research","title":"Crypto Hacks in May 2026: $68.08M Stolen","url":"https://blog.globalledger.io/research-investigations/crypto-hacks-may-2026","by":"Global Ledger","date":"2026-06-03"},{"kind":"news","title":"TrustedVolumes attacker returns $2M, keeps another $2M as bounty","url":"https://crypto.news/trustedvolumes-attacker-returns-2m-keeps-2m-bounty/","by":"crypto.news","date":"2026-07-18"}],"started":"2026-05-07","closed":"2026-07-18","created":"2026-11-03T21:45:09.433Z","updated":"2026-11-03T21:45:09.433Z","cve_notes":[],"timeline":[{"at":"2026-07-18","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Citing Com Feed monitoring, crypto.news reported that 1,122 ETH worth about US$2 million had been returned, while another roughly US$2 million was retained as a claimed bounty. TrustedVolumes had not formally confirmed acceptance of those terms.","url":"https://crypto.news/trustedvolumes-attacker-returns-2m-keeps-2m-bounty/","by":"crypto.news","patch":null},{"at":"2026-05-29","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Global Ledger's subsequent investigation recorded 1,122.1188 ETH still in one attacker address as of this date, worth about US$2.25 million. It also traced stolen funds through Tornado Cash, Railgun and THORChain.","url":"https://blog.globalledger.io/research-investigations/crypto-hacks-may-2026","by":"Global Ledger","patch":null},{"at":"2026-05-07","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"TrustedVolumes offered to discuss a bounty and return of funds. Separately, 1inch said its protocols, systems, infrastructure and user funds were unaffected.","url":"https://cointelegraph.com/news/1inch-fusion-resolver-trusted-volumes-floats-bounty-after-67m-exploit","by":"Cointelegraph","patch":null},{"at":"2026-05-07","added":"2026-11-03T21:35:43.306Z","kind":"disclosed","text":"TrustedVolumes confirmed the theft and reported about US$6.7 million held across three attacker addresses. Blockaid initially valued the drained WETH, USDT, wrapped bitcoin and USDC at US$5.87 million.","url":"https://cointelegraph.com/news/1inch-fusion-resolver-trusted-volumes-floats-bounty-after-67m-exploit","by":"Cointelegraph","patch":"na"}],"url":"https://hard.fyi/live/trustedvolumes-swap-proxy-theft-may-2026/","json":"https://hard.fyi/api/live?id=trustedvolumes-swap-proxy-theft-may-2026"}