Exploit Drains Nearly $6M From 1inch Liquidity Provider

Blockaid reported that an ongoing exploit has drained nearly $6 million from TrustedVolumes, a liquidity provider used by the 1inch decentralized exchange aggregator. The firm said the attack was active and that funds tied to TrustedVolumes were being moved on-chain when it posted its alert.

Blockaid estimated the loss at just under $6 million. The firm flagged transactions moving assets out of addresses associated with TrustedVolumes but did not specify the vulnerability or how the attacker gained access.

TrustedVolumes supplies liquidity to 1inch’s routing system, which pulls liquidity from multiple decentralized exchanges to execute token swaps. Liquidity providers deposit assets into smart contracts or pools that aggregators and trading systems draw from to fill orders.

On-chain monitoring showed transfers from the affected addresses occurring in rapid succession after Blockaid’s notice. The company advised users and other protocols to monitor the related contracts and wallets for further outflows.

At the time of the alert there was no confirmation of any recovery, rollback or intervention by TrustedVolumes, 1inch or chain-level validators.

Security teams and on-chain analysts track such incidents using public transaction data and monitoring nodes. Common causes of similar exploits include compromised private keys, smart contract flaws and integration vulnerabilities; Blockaid did not identify which, if any, applied in this case.

Recovery options vary by incident type. Theft from a compromised private key is typically irreversible on public blockchains, while some smart contract vulnerabilities can be patched if identified early.

The situation remains fluid. Observers will watch transaction flows and any official statements from TrustedVolumes, 1inch or security teams for further details on the cause, scope and any recovery efforts.