DeFi Resolver TrustedVolumes Hit With $6.7M Exploit; 1inch Claims No Impact

TrustedVolumes, a liquidity resolver used across multiple decentralized finance protocols, was exploited on May 7 for between $5.87 million and $6.7 million. Security firm Blockaid detected and reported the breach, which targeted the independent resolver's smart contract infrastructure.

1inch, the major DEX aggregator that integrates TrustedVolumes, moved quickly to distance itself from the incident. The platform stated that its protocols, infrastructure, and user funds were not affected by the exploit. The distinction matters: TrustedVolumes operates as an independent resolver, not as a direct 1inch product, meaning the breach does not automatically cascade to users of 1inch's aggregation services.

A liquidity resolver sits between a user and multiple liquidity sources, optimizing routing to find the best execution prices. TrustedVolumes fills this role for several protocols. When a resolver is compromised, attackers can manipulate price quotes or drain funds held in the contract. The variance in reported loss figures, with some sources citing $5.87 million and others $6.7 million, suggests the full scope of the exploit may still be under assessment.

1inch's rapid public statement reflects a hard-learned lesson in DeFi: interconnected protocols can amplify losses if contagion is not immediately addressed. By clarifying that TrustedVolumes is independent and that 1inch's own systems remain secure, the platform attempted to prevent panic among its user base. Whether this claim holds up depends on the resolver's actual integration depth with 1inch's infrastructure and whether any user transactions routed through TrustedVolumes during the exploit window faced losses.

The timing adds pressure to an already difficult year for DeFi security. Multiple exploits and vulnerabilities have surfaced in 2026, with Blockaid identifying this TrustedVolumes breach as part of a broader pattern. Resolvers and aggregators have become attractive targets because they handle large volumes of liquidity and often operate with minimal redundancy or circuit breakers.

TrustedVolumes has announced a bounty for information leading to recovery of stolen funds, a standard but often ineffective response to major exploits. The real test will be whether other protocols using the resolver choose to migrate away, and whether the resolver's team can identify and patch the underlying vulnerability before it is exploited again.

For DeFi users, the incident underscores a persistent risk: even when using established aggregators like 1inch, the security of downstream dependencies, including resolvers, routers, and liquidity sources, remains a potential weak point. 1inch's explicit denial of impact is reassuring but not absolute proof. Users concerned about their recent transactions should check on-chain records to verify execution prices and whether their slippage was abnormal.