Crypto Heist: $5.87M Vanishes in 1inch’s Magical Wallet Trick

by

Well, butter my blockchain, looks like the crypto world has been treated to another thrilling episode of DeFi Gone Wild. This time, the star of the show is a liquidity provider linked to 1inch’s Trusted Volumes system, which has been relieved of nearly $5.87 million in a heist so slick, it makes Ocean’s Eleven look like a kindergarten play. The attackers made off with a treasure trove of WETH, USDT, WBTC, and USDC, because apparently, stealing digital money is the new black.

But wait, there’s more! Blockchain security firms are waving their hands like maniacs, warning that this exploit might still be ongoing. So, if you’re a DeFi enthusiast, you might want to check your wallet-or better yet, just assume it’s already empty and save yourself the heartbreak.

So, how did this financial magic trick happen? Let’s break it down, shall we?

The Great DeFi Disappearing Act

According to the wizards at Blockaid, the attackers exploited a vulnerability in the Trusted Volumes resolver contract. This wasn’t your run-of-the-mill bug-it was a full-blown loophole that allowed them to execute malicious orders straight from users’ wallets. Think of it as a digital pickpocketing, but instead of your wallet, it’s your entire financial life being lifted.

The trick? Abusing a public function in the contract to add themselves as an “Allowed Order Signer.” Once they had that privilege, they could use old wallet approvals that users had long forgotten about. It’s like finding out your ex still has a key to your house and has been throwing parties while you’re at work.

Blockaid’s exploit detection system has identified an on-going exploit on TrustedVolumes (1inch market maker / resolver, @trustedvolumes ).
Chain: Ethereum

Victim contract: TrustedVolumes resolver – 0x9bA0CF1588E1DFA905eC948F7FE5104dD40EDa31

Exploiter:…

– Blockaid (@blockaid_) May 7, 2026

The real kicker? Users didn’t even need to approve any new transactions. Their existing token approvals were more than enough for the attackers to waltz in and help themselves. It’s like leaving your car unlocked with the keys in the ignition and being surprised when it’s gone the next morning.

This incident shines a spotlight on one of DeFi’s dirtiest little secrets: unlimited token approvals that stick around long after you’ve stopped using a protocol. It’s the digital equivalent of a gym membership you can’t cancel.

Oh, and the cherry on top? The attacker behind this exploit is reportedly the same genius who pulled off the March 2025 1inch Fusion V1 attack. Clearly, they’re not just a one-hit wonder.

The Loot: A Cool $5.9 Million

According to PeckShield, the attacker has already made off with:

  • 1,291.16 WETH (because who doesn’t love a little wrapped Ethereum?)
  • 206,282 USDT (stablecoins for the win)
  • 16.939 WBTC (Bitcoin, but make it fancy)
  • 1,268,771 USDC (more stablecoins, because why not?)

Grand total? A tidy $5.87 million. Not a bad day’s work, if you’re into that sort of thing.

Researchers traced the exploit back to the same resolver contract and vulnerable proxy linked to the 2025 attack. It’s like the crypto version of a sequel-Exploit: The Return. Security experts also noted striking similarities between the two incidents, leading them to the exploiter’s wallet. Spoiler alert: it’s not looking good for the good guys.

DeFi Hacks: The Never-Ending Saga

The TrustedVolumes exploit is just the latest in a string of DeFi disasters. In the past month alone, we’ve seen:

  • A $285 million exploit targeting Drift Protocol (because why not?)
  • A $293 million attack on Kelp DAO (seaweed has never been so expensive)

According to DefiLlama, crypto assets stolen in April 2026 hit a staggering $635.2 million, the highest since the 2025 Bybit exploit, where nearly $1.5 billion vanished into thin air. It’s like the Wild West, but with more spreadsheets and fewer cowboy hats.

So, what’s the moral of this story? Maybe it’s time to stop treating DeFi like a casino and start treating it like, well, finance. Or, you know, just keep your money under your mattress. Either way, it’s been another exciting month in the world of crypto-and by exciting, I mean terrifying.

Read More

2026-05-07 08:51