1inch Market Maker TrustedVolumes Hit by $5.9 Million Signature Validation Exploit

By bobby okposin | may 07, 2026

Signature Validation Flaw Exposed

[{"selector":"#anim-0bd2b694-295d-4afa-aef7-a0e411a025d6","keyframes":{"opacity":[0,1]},"delay":600,"duration":1600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a9b5a23b-5d1b-4523-9918-c300e7c1332f","keyframes":{"transform":["translate3d(-110.6383%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":600,"duration":1600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8b43a4e9-5449-4d16-8027-b93f1d257cab","keyframes":[{"offset":0,"transform":"translate3d(0, -343.73637%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.29,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.45,"transform":"translate3d(0, -96.65866724400001%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.61,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.71,"transform":"translate3d(0, -32.861196972%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.8,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.85,"transform":"translate3d(0, -12.340135683000002%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.92,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.96,"transform":"translate3d(0, -5.362287372%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":1,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"}],"delay":0,"duration":600,"fill":"both"}] Security firms SlowMist and PeckShield identified a critical bug in the RFQ contract’s fillOrder function. The flaw allowed attackers to forge orders by registering as authorized signers.

Negotiation Over Litigation

[{"selector":"#anim-d4b1946f-9cb9-402a-963c-6c18193bff50","keyframes":{"opacity":[0,1]},"delay":800,"duration":1600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-6982bf15-9650-4a00-9996-19143bc144c0","keyframes":{"transform":["scale(1)","scale(1.5)","scale(0.95)","scale(1)"],"offset":[0,0.33,0.66,1]},"delay":0,"duration":1450,"easing":"ease-in-out","fill":"both","iterations":1}] [{"selector":"#anim-94e0ff8b-09f8-43fd-9fb2-af87dfa76ce6","keyframes":{"opacity":[0,1]},"delay":600,"duration":1600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f3cd1e53-568c-4a7f-8237-fce0daa897cd","keyframes":{"transform":["translate3d(-110.33519%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":600,"duration":1600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] TrustedVolumes has reached out to the exploiter, offering a bug bounty to facilitate the return of funds.

The "Unlimited Approval" Warning

[{"selector":"#anim-3cdc9570-d778-41a7-96d3-fce2d25bc79f","keyframes":[{"offset":0,"transform":"translate3d(0, -252.97338%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.29,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.45,"transform":"translate3d(0, -71.136114456%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.61,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.71,"transform":"translate3d(0, -24.184255128%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.8,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.85,"transform":"translate3d(0, -9.081744342%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.92,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.96,"transform":"translate3d(0, -3.9463847279999995%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":1,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"}],"delay":0,"duration":600,"fill":"both"}] [{"selector":"#anim-4abdeb38-1e4d-4708-a20e-75663cce8c24","keyframes":{"transform":["translate3d(-102.89473%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-bcd3d1be-1bae-4ecc-b4d8-32e66fd54a2d","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4ac8587a-92b8-4efc-881c-31f108b1851c","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-a32179a3-bd29-4ac8-bd0c-f572edc30e68","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-086079f0-d2cd-4df7-8d5b-25683e451643","keyframes":{"transform":["translate3d(0px, 2547.22474%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c16f2b98-900c-4f69-a110-c79bb5ea9f1d","keyframes":{"opacity":[0,1]},"delay":600,"duration":1600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2eebf678-15f6-473c-83da-a6abbe5a407b","keyframes":{"transform":["translate3d(-103.17919%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":600,"duration":1600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] The exploit specifically targeted addresses with unlimited approvals, reigniting industry-wide debates on the safety of custodial setups and high-permission smart contracts.

For More Stories!

[{"selector":"#anim-8f71a495-64fc-45ce-b914-3841faa5168f","keyframes":{"opacity":[0,1]},"delay":100,"duration":2000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-12121c4f-2eac-4113-ae03-3866e1c65a9a","keyframes":{"transform":["translate3d(164.03511%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":100,"duration":2000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-33bad2d9-3fe9-4131-9dbd-1a7cce9418ba","keyframes":{"opacity":[0,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-7533afbf-7b2f-4280-a11e-4d6f5e60df74","keyframes":{"transform":["rotate(-8deg) translate3d(-181.8182%, 0px, 0) rotate(8deg)","rotate(-8deg) translate3d(0px, 0px, 0) rotate(8deg)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a1c39401-d88f-4bd1-9c95-828b0bdd98d0","keyframes":{"opacity":[0,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-1ac40583-a5a3-4d30-b531-808de44142d0","keyframes":{"transform":["translate3d(-148.27585%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d7aa3100-044a-4710-bb04-1dd57e40d4ec","keyframes":{"transform":["translate3d(153.44826%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-aa8c7a5d-8e87-4b1e-a27c-df622bf8272e","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-6d7b7344-92d1-4130-bc03-7bad966be5e9","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-5b7b85d1-1883-41df-bb82-edcbd292bca2","keyframes":{"opacity":[0,1]},"delay":300,"duration":2000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3503f905-776d-4762-8981-9ad0c3f6cf74","keyframes":{"transform":["rotate(-8deg) translate3d(184.09095%, 0px, 0) rotate(8deg)","rotate(-8deg) translate3d(0px, 0px, 0) rotate(8deg)"]},"delay":300,"duration":2000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c7e6fad6-b40a-472a-a925-76df15900462","keyframes":[{"offset":0,"transform":"translate3d(0, -321.65528%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.29,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.45,"transform":"translate3d(0, -90.44946473600001%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.61,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.71,"transform":"translate3d(0, -30.750244768%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.8,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.85,"transform":"translate3d(0, -11.547424552%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.92,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.96,"transform":"translate3d(0, -5.017822368%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":1,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"}],"delay":0,"duration":600,"fill":"both"}] Next steps

1inch Market Maker TrustedVolumes Hit by $5.9 Million Signature Validation Exploit

Signature Validation Flaw Exposed

Negotiation Over Litigation

The "Unlimited Approval" Warning

For More Stories!

Visit our Website for the full breakdown

Stay updated