TrustedVolumes swap-proxy theft drains millions; about US$2 million reportedly returned
An attacker drained TrustedVolumes’ crypto inventory through its Ethereum swap proxy. About US$2 million was reportedly returned in July; full recovery remains unconfirmed. If you have exposure through an investment manager, ask them to check it.
There is no device or wallet-app update for this theft. If your family has funds with TrustedVolumes directly or through an investment manager, ask that provider to confirm your exposure, any loss and the recovery position.
What’s happening
On 7 May, an attacker drained crypto assets from TrustedVolumes, a liquidity provider that supplies tokens for trades across decentralised finance services. Its custom Ethereum swap proxy failed to restrict who could authorise trades, allowing unauthorised orders to take its inventory. Researchers initially valued the stolen WETH, USDT, wrapped bitcoin and USDC at US$5.87 million; TrustedVolumes reported about US$6.7 million across three attacker addresses. These were separate reported valuations. TrustedVolumes sought discussions about returning the funds, while 1inch said its own protocols, infrastructure and user funds were unaffected. In July, crypto.news reported a partial return of 1,122 ETH, then worth about US$2 million, with a similar amount retained as a claimed bounty. As of 3 November, the reviewed sources do not establish full recovery, company acceptance of that bounty, or confirmed remediation of the affected proxy.
- What
- Breach
- Affects
- TrustedVolumes liquidity service and custom Ethereum RFQ swap proxy
- Fixed in
- Nothing to patch
- Since
- 7 May 2026
- Closed
- 18 July 2026
Timeline
- Update
Citing Com Feed monitoring, crypto.news reported that 1,122 ETH worth about US$2 million had been returned, while another roughly US$2 million was retained as a claimed bounty. TrustedVolumes had not formally confirmed acceptance of those terms.
- Update
Global Ledger's subsequent investigation recorded 1,122.1188 ETH still in one attacker address as of this date, worth about US$2.25 million. It also traced stolen funds through Tornado Cash, Railgun and THORChain.
- Update
TrustedVolumes offered to discuss a bounty and return of funds. Separately, 1inch said its protocols, systems, infrastructure and user funds were unaffected.
- Made publicNothing to patch
TrustedVolumes confirmed the theft and reported about US$6.7 million held across three attacker addresses. Blockaid initially valued the drained WETH, USDT, wrapped bitcoin and USDC at US$5.87 million.
Sources
- TrustedVolumes exploit statement, reproduced by Cointelegraph; original X post could not be retrievedTrustedVolumes, via Cointelegraph · 7 May 2026
- TrustedVolumes confirms $6.7 million exploit, seeks “constructive” talks with hackercrypto.news · 7 May 2026
- Explained: The TrustedVolumes Hack (May 2026)Halborn · 11 May 2026
- Crypto Hacks in May 2026: $68.08M StolenGlobal Ledger · 3 June 2026
- TrustedVolumes attacker returns $2M, keeps another $2M as bountycrypto.news · 18 July 2026