
The TrustedVolumes exploiter moved 110 ETH via THORChain to BTC and 10.2 ETH to TornadoCash, laundering $278K of the $6.7M theft. The platform is open to negotiation.
A hacker who drained $6.7 million from liquidity provider TrustedVolumes on May 7 has begun moving the stolen funds, according to blockchain security firm PeckShield. The laundering activity has already shifted $278,000 in crypto through mixers and cross-chain bridges, with the bulk of the loot still sitting in identified wallets.
PeckShield reported that the exploiter deposited 10.2 ETH (worth about $23,600) into TornadoCash, a coin-mixing service, and laundered 110 ETH (roughly $250,000) via THORChain to Bitcoin. The use of THORChain to swap into BTC is a common technique to break on-chain traceability. Bitcoin's UTXO model can complicate tracking compared to Ethereum's account model.
The hacker also attempted to deposit 0.5 ETH into Railgun, a privacy protocol, then reversed the transaction. That reversal may indicate a change in laundering strategy or a test of the protocol’s monitoring. Railgun has been used in other exploits. The small amount and quick reversal suggest the attacker is still probing for the most effective off-ramp.
TrustedVolumes posted a statement indicating willingness to negotiate a bug bounty and a “mutually acceptable resolution.” The firm also published three wallet addresses that hold the bulk of the stolen assets: two wallets containing approximately $3 million each and one with $700,000. That disclosure puts pressure on the hacker, as any movement from those addresses will be immediately visible.
The offer of a bug bounty is a common tactic in DeFi exploits, sometimes leading to partial fund recovery. The hacker’s active laundering, however, suggests they may not be inclined to negotiate immediately. The publication of wallet addresses also signals that TrustedVolumes is working with blockchain analytics firms to track the funds.
Blockchain security firm QuillAudits analyzed the attack and found that the hacker exploited a design flaw in TrustedVolumes’ custom Request-for-Quote (RFQ) proxy system. TrustedVolumes operates as a 1inch market maker and resolver, providing on-chain liquidity through this RFQ model.
In an RFQ model, a maker pre-signs orders quoting a specific price for a token pair. A taker presents that signed quote to the settlement contract, which verifies the signature and executes the swap atomically. The system relies on three guarantees:
QuillAudits stated that in the TrustedVolumes implementation, all three guarantees failed simultaneously. The attacker crafted a single composed transaction that bypassed authorization checks, replayed a valid signature, and sourced tokens from an address not belonging to the maker. That allowed the hacker to drain $6.7 million in a single transaction.
The exploit highlights the risk of custom settlement logic that deviates from standard, audited patterns. TrustedVolumes’ RFQ proxy was not a standard 1inch contract but a bespoke implementation, which introduced vulnerabilities that a routine audit might have missed.
The TrustedVolumes exploit is a case study in how a single design flaw can cascade into a full drain when multiple security assumptions fail at once. The hacker’s laundering activity shows a methodical approach, mixing small amounts through TornadoCash and bridging larger sums to Bitcoin. For traders and liquidity providers, the immediate risk is not just the lost funds but the potential for similar exploits on platforms that have built custom settlement logic without rigorous, multi-audit review. The next concrete marker is whether TrustedVolumes can negotiate a partial return before the remaining funds disappear into privacy tools. For broader context on crypto security risks, see crypto market analysis.
Drafted by the AlphaScala research model and grounded in primary market data – live prices, fundamentals, SEC filings, hedge-fund holdings, and insider activity. Each story is checked against AlphaScala publishing rules before release. Educational coverage, not personalized advice.