TrustedVolumes represents a cautionary tale in DeFi security: a 2012-founded company with 100+ engineers deployed a smart contract with four simultaneous critical vulnerabilities and no prior audit. The $6.7M exploit in May 2026 — by the same attacker behind the 2025 1inch hack — reveals dangerous overconfidence in engineering capability over security process. Avoid any capital exposure to this platform until a clean third-party audit is published.
Risk Breakdown
Top Risks
May 2026: $6.7M drained via four compounding critical vulnerabilities in the RFQ proxy — unguarded signer registration, authorization-source mismatch, broken replay protection, and unlimited ERC-20 approvals
No public smart contract audits before the exploit — fundamental access control flaws would have been caught by any standard audit
Same attacker previously exploited the 1inch Fusion V1 in March 2025 ($5M); TrustedVolumes failed to apply lessons from that industry-wide incident
The unguarded registerAllowedOrderSigner() function was publicly callable with zero access restrictions — privileged function exposed as public by design
Recovery status uncertain: TrustedVolumes is in bounty negotiations with the attacker; full fund recovery not confirmed as of May 2026
Frequently Asked Questions
Is TrustedVolumes safe to use?
What are the main risks of using TrustedVolumes?
What is TrustedVolumes's risk score breakdown?
How does TrustedVolumes compare to other DEX protocols?
Has TrustedVolumes ever been hacked or exploited?
Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.