TrustedVolumes Hack: When DeFi Infrastructure Becomes a Compliance Liability

On May 7, TrustedVolumes — a liquidity provider connected to the 1inch DEX aggregator — was exploited for approximately $5.87 million (though losses were reported as higher).  

Another DeFi hack, another set of stolen funds. But the way this attack was built, and where the money is sitting right now, tells a bigger story about how DeFi exploits create compliance exposure for VASPs.  

In this article, we break down what happened, why DeFi is becoming an increasingly easy target for hackers, and what it means for compliance teams.

TrustedVolumes Hack: What Happened

On May 7, TrustedVolumes was drained of $5.87 million (although the reported loss was higher — $6.7 million).  

The attack was fast. According to our data, the first transaction went through just 13 minutes and 4 seconds after the exploit started, with the first swap following about 10 minutes later.

A small part of the funds moved toward mixers and privacy protocols almost immediately: 10.2 ETH ($23,735) went to Tornado Cash, and 0.45 ETH ($1,053) was sent to RailGun. But most of the money — ~$5.86 million — has not moved since, spread across four known wallets:

• 0xc3…9100 — 1,169.9611 ETH (~$2.74M)

• 0x61…2d1c — 1,222.1188 ETH (~2.86M)

• 0x0c…7836 — 0.44201061 ETH (~1.03K)

• bc1q…x0yt — 3.15394517 BTC (~257.6K)

As of May 7, 2026. TrustedVolumes hacked for $5.87M — nearly $5.86M still unspent. Source: Global Ledger

TrustedVolumes worked as a resolver inside 1inch's RFQ system — essentially a market maker that held real assets and executed swaps on demand. The attacker found a flaw in how the smart contract validated incoming requests and used it to drain the funds as if they were a legitimate trade. 1inch itself was not directly impacted.

DeFi Hack Losses Reach Record Highs

TrustedVolumes is part of a much larger wave. April 2026 set a 2026 record: $641.67 million stolen across the month. DeFi drove the majority of losses, with two incidents — KelpDAO hack ($293 million) and Drift Protocol ($285 million) — making up ~88% of the total.

According to the Global Ledger Laundering Race report, DeFi became the second most used laundering route: H2 volumes hit ~$732M, up 4.3× from H1 (bridges rank first).  

Why DeFi Keeps Getting Hit

DeFi is not a soft target by accident. Several structural features make it attractive to attackers:

• Permissionless architecture. Most DeFi protocols are open smart contracts. There is no KYC, no ability to reverse transactions once confirmed.

• Speed and liquidity. Large amounts can be moved and swapped across protocols in minutes, often before any monitoring system has processed the first alert.

• Composability creates an attack surface. DeFi protocols plug into each other — a resolver connects to an aggregator, which connects to liquidity pools across multiple chains. Each integration is a potential point of failure, and a vulnerability in one layer can cascade into another.

• Low cost of obfuscation. Once funds are in DeFi, they can be routed through bridges, swapped across chains, split across dozens of wallets, and mixed — all within minutes, in a single coordinated sequence.

The TrustedVolumes case illustrates this well: the attacker moved from exploit to bridge (Tornado Cash, RailGun) within minutes. The bulk of the funds are now sitting quietly, and licensed exchanges may well be the next stop for cash-out.

What This Means for Compliance Teams

DeFi exploits do not stay in DeFi.

The bridges, DEX swaps, mixer deposits, and RFQ resolver hacks are not isolated incidents — they are steps in a larger, deliberate laundering strategy. Hackers have become more cautious: they move quickly in the first minutes, then slow down and wait. The goal is to let the noise settle, fragment the trail, and eventually route funds toward regulated institutions for cash-out — but only once the obvious connections are hard to trace.

For compliance teams, this creates three specific risks worth naming:

1. CEXs are usually the cash-out point.
   Attackers avoid centralized exchanges in the early stages — public disclosure is getting faster, and direct routes to CEXs are more likely to be blocked. Instead, they shift to fragmented, multi-hop laundering through DeFi. That is exactly why the cash-out attempt often comes later, when the link to the original exploit is no longer obvious.

2. Unspent funds are not resolved risk.
   The $5.86 million sitting in TrustedVolumes-linked wallets will move at some point. So will the $1.97 billion in unspent 2025 hack proceeds documented in the Global Ledger report. Early reporting reduces immediate exposure, but the real risk is downstream — and it requires continuous monitoring, not a one-time incident response.

3. Transactions may look “clean” by arrival.
   A deposit that has passed through three bridges, two DEXs, and a mixer may carry no obvious flag when it reaches your platform. Without visibility into the full path, standard screening can miss it.

To Conclude

As attack activity becomes more fragmented — with funds increasingly passing through bridges, mixers, and services with limited or no KYC controls — deposits arriving from unclear or high-risk sources require closer scrutiny.  

Screening the known TrustedVolumes-linked addresses is the immediate step, but the broader posture matters more.

Enhanced due diligence (EDD) is the practical tool here. With the right AML platform on board, your compliance team can:

• Apply stricter rules for deposits originating from instant swap or non-KYC sources.

• Trigger EDD reviews for flows linked to mixers, bridges, or sanctioned wallets.

• Use hold-and-review policies to freeze funds while the investigation is still open.

Global Ledger's KYB solution helps compliance teams generate comprehensive entity exposure reports for custom time periods — all transactions, counterparties, and high-risk entities in one place. It also supports dedicated DeFi reports on contract addresses, covering lending, staking, and other on-chain activity by requested period.

This way, your team always knows what it's dealing with before making the next compliance decision.

FAQ