![](\"http:\/\/sitedemo.beget.tech\/559\/wp-content\/uploads\/2026\/07\/d099eac3bca7d39a56eb4540fba8ccfc.jpg\")
<\/p>\n<\/p>\n
<\/p>\n
A TrustedVolumes attacker has returned 1,122 $ETH<\/span> worth about $2 million while keeping another $2 million as a self-declared bounty.<\/p>\n According to Com Feed monitoring, the Ethereum transfer represents a partial recovery from the May exploit, which initially drained about $5.87 million from a contract controlled by the liquidity provider. The attacker has retained roughly the same dollar amount as the returned funds, labeling it a bounty.<\/p>\n \u26a0\ufe0f JUST IN: The TrustedVolumes exploiter has returned 1,122 $ETH<\/span> ($2M+<\/p>\n The original exploit resulted in more than $5.8M being stolen. The exploiter has now returned around $2M while retaining another $2M as a \u201cbounty” pic.twitter.com\/HJSdx4i4Or<\/p>\n \u2014 Com Feed (@thecomfeed) July 18, 2026<\/p><\/blockquote>\n At the time of writing, TrustedVolumes had not formally confirmed that it had accepted the attacker\u2019s bounty terms.<\/p>\n TrustedVolumes disclosed in May that the total loss had reached roughly $6.7 million, exceeding the initial estimate reported by security researchers. The company said at that time the stolen assets were held across three addresses containing approximately $3 million, $3 million, and $700,000.<\/p>\n Seeking to recover the assets, TrustedVolumes offered to discuss a vulnerability bounty and what it called a mutually acceptable solution. The liquidity provider also invited the attacker to begin constructive communication, though its statement did not specify a proposed bounty rate.<\/p>\n Before the stolen tokens were consolidated, Blockaid identified 1,291.16 WETH, 206,282 $USDT<\/span>, 16.939 WBTC, and 1.27 million $USDC<\/span> among the drained assets. PeckShield later reported that the attacker exchanged the tokens and gathered the proceeds into about 2,513 $ETH<\/span>.<\/p>\n The returned 1,122 $ETH<\/span> was worth about $2 million at the time of writing, while Com Feed valued the attacker\u2019s retained bounty at a similar amount. The combined dollar value is lower than the original loss because $ETH<\/span> has fallen since the May exploit, when the stolen assets were converted into the cryptocurrency.<\/p>\n As previously reported by crypto.news, Blockaid traced the May 7 attack to a custom request-for-quote swap proxy operated by TrustedVolumes. According to the security firm, the attacker targeted the company\u2019s Ethereum resolver setup rather than a regular 1inch swap route.<\/p>\n TrustedVolumes used the RFQ system to quote token prices and complete signed trades from its inventory. Verichains found that a public function lacked access controls, allowing the attacker to register an address as an approved order signer and create transactions that appeared valid to the proxy.<\/p>\n\n
Partial repayment recovers only part of the stolen funds<\/h2>\n
Custom TrustedVolumes proxy caused the security breach<\/h2>\n