1inch Aggregator Suffers Security Breach, Loses $5M

YEREVAN (CoinChapter.com) — Decentralized exchange (DEX) aggregator 1inch suffered a security breach on March 5, resulting in the theft of $5 million.

Decentralized exchange (DEX) aggregator 1inch disclosed on Monday that it suffered a security breach on March 5, resulting in the theft of $5 million.

The exploit targeted an outdated smart contract, known as Fusion v1, which is used by the protocol for resolving transactions. However, following several days of negotiation, the attacker returned most of the funds and is expected to keep a portion as a bug bounty.

The breach occurred due to a vulnerability in an older version of a contract within the 1inch ecosystem. An attacker used outdated logic to bypass security measures and execute transactions without authorization.

Decurity, a crypto security firm, reported on the incident, which took place at 6 PM UTC on March 5.

Later, the hacker himself posted on-chain messages, indicating that they were in possession of stolen assets and demanded a bug bounty in return for returning the funds.

The targeted entity was TrustedVolumes, a third-party market maker that provides liquidity to 1inch and other protocols, rather than individual users.

After the attack was detected, 1inch and TrustedVolumes quickly engaged in communication with the hacker to negotiate the return of the stolen coins.

According to a report by WuBlockchain, which cited Decurity, the parties reached an agreement, and the attacker is expected to keep a portion of the $5 million as a bounty.

This incident showcases a growing trend in decentralized finance (DeFi) over the past year, where attackers often prefer to negotiate with victims and return at least some of the stolen funds.

In response to the breach, 1inch has been actively updating its resolver contracts to Fusion v2, preventing any further unauthorized transactions. The company also confirmed that no user funds were affected by the incident.

This marks the second major security breach for 1inch in the last six months. In October, the platform experienced a front-end compromise due to a supply chain attack.

These events highlight the ongoing cybersecurity challenges faced by DeFi protocols as they strive to protect their platforms and users from malicious actors.

The latest breach also underscores the need for robust monitoring systems, regular smart contract audits, and swift incident response capabilities to mitigate the impact of such attacks.

As 1inch continues to fortify its security measures, the focus remains on detecting vulnerabilities more effectively and preventing similar breaches in the future.