Leaderboard
320All-time rank
1inch Swap
Mar 7, 2025
$5.0M
Lost
$5.0M
Recovered
$0
Net loss
$5.0M
Unrecovered0% recovered
On March 5, 2025, 1inch disclosed a $5M exploit in Fusion v1 resolver contracts when a buffer overflow in _settleOrder() allowed an attacker to trigger integer underflow and hijack control flow to impersonate resolvers and execute unauthorized swaps. Most funds were recovered after negotiation.
How the exploit worked
View reproducible PoCArbitrary Yul Calldata.
Lost: 4.5M
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Arbitrary External Call
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Mar 7, 2025Exploit executed — $5.0M drained via arbitrary external call
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)