{"id":48048,"date":"2026-07-18T10:55:20","date_gmt":"2026-07-18T10:55:20","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=48048"},"modified":"2026-07-18T10:55:20","modified_gmt":"2026-07-18T10:55:20","slug":"trustedvolumes-attacker-returns-1122-eth-keeps-2m-in-bounty-deal","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=48048","title":{"rendered":"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal"},"content":{"rendered":"

A negotiated settlement has once again outpaced a long asset recovery process as one of the attackers of TrustedVolumes, a liquidity resolver linked to 1inch Fusion, has returned 1,122.12 ETH in an Ethereum transfer, more than two months after the incident. The hacker has allegedly retained a similar amount as part of a negotiated bug bounty agreement, as reported by Defimon Alerts.<\/strong><\/p>\n

When the deal was made, Ether\u2019s price was roughly estimated at $1,843, thus making the total value of the recovery approximately $2.07 million and clarifying why this event is usually called the \u201c$2 million recovery.\u201d<\/p>\n

The importance of the deal is not defined by how large it is, but by the fact that it reflects the increasing tendency in decentralized finance. Increasingly, organizations are turning to negotiating with their attackers as opposed to relying only on law enforcement or lengthy court cases. While this approach may provide quicker results, it raises the fear that extortionists will begin to view bug bounty negotiations as a way to avoid being caught rather than as an exception.<\/p>\n

Both parties posted a message on-chain<\/a> confirming the settlement.<\/p>\n

\u201cWe have finalized the negotiations with the original exploiter,\u201d the message said<\/p>\n

\n

More than 2 months after $5.8M @trustedvolumes<\/a> exploit one of the attackers returned 1,122 ETH ($2M):https:\/\/t.co\/N2nZ3xSVPn<\/a> https:\/\/t.co\/auPXtWRLT1<\/a><\/p>\n

\u2014 Defimon Alerts (@DefimonAlerts) July 17, 2026<\/a><\/p><\/blockquote>\n

Moreover, the exploiter \u201creturned the funds and received their bug bounty,\u201d the message added, encouraging any remaining attackers to write to tvbugbounty@proton.me. TrustedVolumes hinted at this approach right after the exploit, saying that the company was willing to have \u201cconstructive communication regarding a bug bounty and a mutually acceptable resolution.\u201d<\/p>\n

What was taken in May<\/strong><\/h3>\n

TrustedVolumes worked as a resolver in the 1inch Fusion environment, allowing for the operation of a Request-For-Quote (RFQ) market, which provided liquidity for token exchanges when needed. On 7 May, an attack took place whereby the resolver was exploited and approximately $5.87 million worth of digital assets were withdrawn in a single Ethereum<\/a> transaction. Later data by the protocol suggested that the damage after accounting for asset values and related losses could reach about $6.7 million.<\/p>\n

According to the analysis of Blockaid<\/a>, in total $5.87 million was lost, which included 1,291 WETH, 1.26 million USDC, 206,282 USDT, and 16.93 WBTC. The compromised resolver contract was determined to be 0x9bA0CF1588E1DFA905eC948F7FE5104dD40EDa31, while the attack was connected to a bespoke RFQ proxy contract launched at 0xeEeEEe53033F7227d488ae83a27Bc9A9D5051756. The main attacker wallet 0xC3EBDdEa4f69df717a8f5c89e7cF20C1c0389100, however, was classified as a TrustedVolumes exploit address by Etherscan.<\/p>\n

Cybersecurity researchers found that methods that were used in this attack were very similar to those used in the hack from March 2025 involving the 1inch Fusion V1 system.<\/p>\n

Investigators determined that the hack happened due to an access-control vulnerability rather than the theft of private keys or some previously unknown exploit. Halborn discovered<\/a> that due to a public function, any individual could register as an authorized order signer. The attackers then approved unauthorized orders transferring money that had already been approved for the proxy contract. Blockaid was able to identify the exploit while it happened and noted that neither 1inch\u2019s infrastructure nor user funds were affected.<\/p>\n

Why the incentives cut both ways<\/strong><\/h3>\n

The settlement showcases the challenges the DeFi industry faces. It is often more desirable to negotiate and reclaim stolen funds rather than face the possibility of losing everything at the end of long and unpredictable investigations. However, these settlements can create a financial rationale that leads criminals to believe that they can steal money and then negotiate for a large payoff afterward.<\/p>\n

Calculating the theft is becoming increasingly complex as the forensics in blockchain keep getting better. TRM Labs found<\/a> that cryptocurrency scams robbed people of $2.87 billion in 2025 through approximately 150 incidents, but at the same time, investigators have been rather successful in tracing the stolen crypto and following the laundering routes. For instance, in the TrustedVolumes case, Blockaid, CertiK, and SlowMist were able to monitor the theft as soon as it happened and to track how the hacker converted the stolen goods into ETH, which helped make the criminals feel more uneasy before the deal was cut.<\/p>\n

Only part of the case was settled through the deal. One attacker returned 1,122.12 ETH or approximately $2.07 million at the moment of the transaction; however, held a similar amount as stated in the proposed bug bounty. Recovery of the rest of the stolen funds may come from either reaching a settlement in the future or laundering the stolen money and will be an excellent gauge of how future hacks\u2019 offenders weigh their chances of being traced by blockchain security against the possibility of negotiating their way out.<\/p>\n

Don\u2019t just read crypto news. Understand it. Subscribe to our newsletter. It’s free<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

A negotiated settlement has once again outpaced a long asset recovery process as one of the attackers of TrustedVolumes, a liquidity resolver linked to 1inch Fusion, has returned 1,122.12 ETH in an Ethereum transfer, more than two months after the incident. The hacker has allegedly retained a similar amount as part of a negotiated bug […]<\/p>\n","protected":false},"author":1,"featured_media":48049,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[47],"tags":[],"class_list":["post-48048","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum"],"yoast_head":"\nTrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=48048\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"A negotiated settlement has once again outpaced a long asset recovery process as one of the attackers of TrustedVolumes, a liquidity resolver linked to 1inch Fusion, has returned 1,122.12 ETH in an Ethereum transfer, more than two months after the incident. The hacker has allegedly retained a similar amount as part of a negotiated bug […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=48048\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-18T10:55:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"560\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal\",\"datePublished\":\"2026-07-18T10:55:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048\"},\"wordCount\":815,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/hackers-are-buying-eth-3-wallets-flip-38m-dai-for-ethereum-Lw7109.webp\",\"articleSection\":[\"Ethereum\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048\",\"name\":\"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/hackers-are-buying-eth-3-wallets-flip-38m-dai-for-ethereum-Lw7109.webp\",\"datePublished\":\"2026-07-18T10:55:20+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=48048\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/hackers-are-buying-eth-3-wallets-flip-38m-dai-for-ethereum-Lw7109.webp\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/hackers-are-buying-eth-3-wallets-flip-38m-dai-for-ethereum-Lw7109.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48048#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=48048","og_locale":"en_US","og_type":"article","og_title":"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal - Cryptomag","og_description":"A negotiated settlement has once again outpaced a long asset recovery process as one of the attackers of TrustedVolumes, a liquidity resolver linked to 1inch Fusion, has returned 1,122.12 ETH in an Ethereum transfer, more than two months after the incident. The hacker has allegedly retained a similar amount as part of a negotiated bug […]","og_url":"https:\/\/cryptomag.finance\/?p=48048","og_site_name":"Cryptomag","article_published_time":"2026-07-18T10:55:20+00:00","og_image":[{"width":1000,"height":560,"url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp","type":"image\/webp"}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=48048#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=48048"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal","datePublished":"2026-07-18T10:55:20+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=48048"},"wordCount":815,"image":{"@id":"https:\/\/cryptomag.finance\/?p=48048#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/hackers-are-buying-eth-3-wallets-flip-38m-dai-for-ethereum-Lw7109.webp","articleSection":["Ethereum"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=48048","url":"https:\/\/cryptomag.finance\/?p=48048","name":"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=48048#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=48048#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/hackers-are-buying-eth-3-wallets-flip-38m-dai-for-ethereum-Lw7109.webp","datePublished":"2026-07-18T10:55:20+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=48048#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=48048"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=48048#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/hackers-are-buying-eth-3-wallets-flip-38m-dai-for-ethereum-Lw7109.webp","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/hackers-are-buying-eth-3-wallets-flip-38m-dai-for-ethereum-Lw7109.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=48048#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"TrustedVolumes attacker returns 1,122 ETH, keeps $2M in bounty deal"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/48048","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=48048"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/48048\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/48049"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=48048"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=48048"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=48048"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}