1inch Fusion v1 Resolver (TrustedVolumes) hack — March 2025

On 5 March 2025 an attacker drained a market-making resolver connected to 1inch's Fusion order-settlement system on Ethereum. Decurity, whose post-mortem 1inch linked to for technical detail, identified the victim as TrustedVolumes and timed the first exploit transaction at 17:31 UTC.

The flaw sat in the deprecated Fusion v1 Settlement contract, retired in mid-2023 but still trusted by some resolver contracts. Its _settleOrder() routine calculated where to write an order suffix from an attacker-influenced interactionLength value without bounds checks. By supplying a value equivalent to minus 512, the attacker caused an underflow in the memory offset, so the genuine suffix was written into padding and a forged suffix containing an arbitrary resolver address was read in its place. Because resolvers trusted data forwarded by the Settlement contract on the basis of msg.sender alone — which genuinely remained the Settlement contract throughout — the forged data inherited settlement-level authority, letting the attacker force swaps such as 6 wei of USDT for 1,000,000 USDC against the victim's balance.

Reported losses were about $5 million, comprising roughly 2.4 million USDC and 1,276 WETH. BlockSec described the total as over $5 million. 1inch said the issue was confined to contracts still using the obsolete Fusion v1 implementation, that Fusion v2 was unaffected and that no end users were affected and their funds remained safe, and that it had proactively redeployed the relevant contract as a precautionary measure.

Negotiations began the same evening. Decurity recorded the attacker returning everything except a bounty portion by 04:12 UTC on 6 March. Neither Decurity nor 1inch published the size of the retained bounty.