Leaderboard
281All-time rank
T
TrustedVolumes
May 7, 2026
$6.7M
Lost
$6.7M
Recovered
$0
Net loss
$6.7M
Unrecovered0% recovered
An attacker exploited missing access control in TrustedVolumes' RFQ swap proxy to add themselves to the order signer allowlist, forge trade orders, and drain funds across 85 transactions in WETH, WBTC, USDT, and USDC.
How the exploit worked
View reproducible PoCSignature Replay.
Lost: ~$5.87M
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- Other
- Classification
- Access Control
- Technique
- Caller Impersonation
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- May 7, 2026Exploit executed — $6.7M drained via caller impersonation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)