1inch hit by $5 million exploit in outdated smart contract

Blockchain security firm SlowMist has reported that DeFi aggregator 1inch suffered an exploit in its resolver smart contract, resulting in losses exceeding $5 million.

On March 7, SlowMist founder Yu Xian revealed that attackers drained approximately 2.4 million USDC and 1,276 Wrapped Ethereum (WETH) from the affected smart contract.

He clarified that regular users were largely unaffected, but resolvers utilizing the outdated Fusion v1 framework bore the brunt of the attack.

1inch confirms breach

On March 6, 1inch acknowledged the exploit, stating that the vulnerability was discovered in certain resolver smart contracts a day earlier.

The team confirmed that only resolver contracts running the obsolete Fusion v1 implementation were impacted. They reassured users that their funds remained secure, with losses limited to affected resolvers.

Following the incident, 1inch launched efforts to assist impacted resolvers in securing their systems. The platform also urged all resolvers to audit and update their contracts to prevent further attacks.

Resolvers play a crucial role in the 1inch ecosystem. These automated algorithms assess which orders to fulfill and act as market makers, providing liquidity to 1inch swappers.

Although the platform did not disclose specific financial losses, it has introduced a bug bounty program to gather more insights into the incident.

The program offers rewards between $100 and $500,000. At the time of writing, 1inch received 58 submissions and paid $200 in bounties.

1Inch ecosystem growth

Despite these setbacks, 1inch remains a dominant player in the DeFi sector, according to Messari’s latest report.

The report noted that 1inch facilitated 38.2% of all DEX volume routed through aggregators on supported blockchains during the fourth quarter of 2024.

However, its market share dropped by 10% quarter-over-quarter as competitors Odos and CoWSwap gained traction.

Nevertheless, 1Inch’s decentralized exchange (DEX) trading volume surged by 104% quarter-over-quarter, rising from $493.5 billion to $1.09 trillion.

The Aggregation Protocol, responsible for routing most trades on 1inch, recorded a 37% increase in daily average volume, reaching $369.7 million in Q4.

Ethereum led as the dominant blockchain for 1inch transactions, accounting for 66% of the Aggregation Protocol’s volume.

The Coinbase-backed Base emerged as the second-largest chain with an 11% market share, surpassing Arbitrum, which dropped from 14% to 10%. These three networks contributed 87% of the platform’s total volume.

Source