Crypto & Web3

Attack Detected on 1inch-Affiliated Liquidity Provider, Approximately $5.87 Million Drained

Nowpattern

10 5月 2026 — 3 min read

c Tactical Track

Will 1inch officially announce the recovery of more than 50% of the drained funds or a negotiated agreement with the attacker by May 21, 2026?

60%

📅 Resolution: 2026-05-21 🎯 Brier: 0.19

c Strategic Track

Will the top 5 DEX aggregators develop and publish unified security audit standards for liquidity providers by the end of 2026?

70%

📅 Resolution: 2026-12-31 🎯 Brier: 0.19

What Happened

⚡ What Happened

A vulnerability was reportedly exploited in the infrastructure of "TrustedVolumes," a liquidity provider affiliated with DEX aggregator 1inch, resulting in an estimated outflow of approximately $5.87 million (roughly ¥880 million). Security firm Blockaid announced on May 7 that it had detected an ongoing attack. Attacks on DeFi's infrastructure layer exploit vulnerabilities in third-party layers rather than the protocol itself, potentially affecting the trustworthiness of the entire ecosystem. The official response from 1inch and TrustedVolumes and the determination of the full extent of damages are now the focus.

A key aspect of this attack is that it targeted the third-party infrastructure layer responsible for liquidity provision, rather than the DEX aggregator itself. Since the 2022 Wormhole bridge hack ($320 million) and the 2023 Curve Finance exploit, a pattern has become established in DeFi where "peripheral infrastructure rather than the protocol itself" becomes the target of attacks. While the estimated $5.87 million in damages is mid-range for a DeFi hack, 1inch is one of the largest DEX aggregators, and damage to trust in the liquidity provider layer could ripple through to routing efficiency and slippage. The fact that security firm Blockaid detected the attack demonstrates the maturation of real-time monitoring infrastructure, though it may not have been able to completely prevent the attack from progressing. DeFi's "composability" structurally carries supply chain attack risks as the trade-off for convenience, and there is a high probability that incidents of this kind will continue to recur.

🔍 Reporting has not clearly distinguished the impact on the 1inch protocol itself, but the liquidity provider's vulnerability exists in a layer that 1inch's routing algorithm depends on—meaning the explanation that "the core protocol is unaffected" is technically accurate but practically indistinguishable from the user's perspective. The fact that TrustedVolumes, a relatively low-profile provider, was targeted illustrates where the "weak links" in the DeFi ecosystem lie. Additionally, the estimated $5.87 million is a sufficient incentive for the attacker, yet also falls within a range where white-hat bug bounty negotiations could potentially succeed. Note that the damage amount is currently an estimate and may change as investigations proceed.

📰 Source: NewEconomy

Causal Analysis

🧭 Why This Is Moving Now

Causal Map

Referenced Knowledge

domain:crypto

domain=crypto

This topic falls under the `crypto` domain, where Nowpattern's average Brier score is 0.1818. It should be treated as a domain prone to overconfidence.

Prediction

🔮 Next Scenarios

● Optimistic 25% ● Base 50% ● Pessimistic 25%

🟢 Optimistic 25% The attacker returns the majority of funds as a white hat, trust in the 1inch ecosystem recovers quickly, and security enhancements accelerate.

🔵 Base 50% The majority of funds are unrecoverable. 1inch strengthens audit standards for liquidity providers, but TVL declines in the short term. Market impact remains limited.

🔴 Pessimistic 25% Additional vulnerabilities are discovered, expanding the damage, or similar attacks spread to liquidity providers of other DEX aggregators, leading to a broader decline in trust across DeFi.

🎯 Incentive Map

Player	True Incentive	Underlying Weakness	Predicted Action
1inch (Protocol Operator)	Minimize brand damage and prevent TVL outflows. Wants to clearly separate responsibility between itself and the liquidity provider	The contradiction of being unable to fully manage complex ecosystem dependencies while wanting to project "safety" to users	Swiftly review its relationship with TrustedVolumes and announce enhanced audits. Reluctant on victim compensation but may consider partial reimbursement depending on community pressure
Attacker	Maximize profit. The estimated $5.87 million is a launderable amount via mixers and bridges, but the attacker is also aware of tracking risks	Complete anonymization is difficult due to on-chain transparency. Also has the option of gaining legitimate profit through bug bounty negotiations	In the short term, will attempt to move funds via mixers and cross-chain bridges, but may agree to partial return negotiations if tracking pressure increases
Blockaid (Security Firm)	Showcase its detection capabilities and establish its position in the DeFi security market	Vulnerable to criticism that detection did not translate to full prevention of the attack. Will be evaluated on the accuracy of its post-incident analysis	Publish a detailed post-mortem report and intensify marketing of its real-time defense solutions

⚠️ Pre-Mortem — Conditions Under Which This Prediction Fails

If the attacker is a white hat and early fund return is achieved through bug bounty negotiations (precedent exists in DeFi with cases like Euler Finance)
If on-chain tracking leads to fund freezes and recovery via CEXs proceeds faster than expected
If the actual damage amount is significantly smaller than initially reported and is automatically covered by protocol insurance

Fear-Setting / When this prediction fails

This probability fails if the attacker returns funds within 48 hours as a white-hat, as seen in the Euler Finance case (March 2023).
This probability fails if on-chain forensics quickly identify the attacker and law enforcement freezes funds at centralized exchanges within the 14-day window.
This probability fails if TrustedVolumes had undisclosed insurance coverage that enables rapid reimbursement announced as 'recovery'.

🎯 Resolution Criteria

Hit Condition: HIT if 1inch or TrustedVolumes officially announces the recovery of more than 50% of the drained funds or a negotiated agreement with the attacker by May 21, 2026

Resolution Date: 2026-05-21

Nowpatte

Toranpu Cai Pan Suo Nidui Chu Suru Fa Yan Zui Gao Cai Guan Shui Wei Xian Pan Jue Gayao Rasusan Quan Nojun Heng

Ri Ben No Zi Zhu Fang Wei Fa An Zhan Hou 80Nian Noan Quan Bao Zhang Tabugabeng Rerugou Zao Li Xue

Deepening of Russian-Iranian Military Cooperation — “Double-front pressure” structure

Gao Shi Shou Xiang No Ji Shu Zi Yuan Wai Jiao Ji Zhong Ri Ri Ben Gaaienerugidi Zheng Xue Nojie Jie Dian Womu Zhi Sugou Zao Zhuan Huan