
Bitcoin treasury firms outline $3 trillion opportunity in BTC-backed digital credit at Consensus
Bitcoin treasury executives identify a $3 trillion opportunity in digital credit, with the market already at $10 billion.

TrustedVolumes, a DeFi liquidity resolver, suffered a $6.7 million exploit, draining various cryptocurrencies. 1inch confirmed that its systems were unaffected by the incident, which was linked to flaws in the contract's security.
Mentioned in this story
🚨 We were recently exploited.
The addresses currently holding the stolen funds are:
— approx. $3M — approx. $3M []
[] —…
— TrustedVolumes (@trustedvolumes) May 7, 2026 Hakan Unal, senior security operations lead at crypto security firm Cyvers, told *Decrypt* the root cause was a combination of “permissionless signer registration, broken replay protection, and an unvalidated transfer source field.” The flaws let the attacker act as a trusted signer and drain victims without valid authorization, with funds routed through high-risk no-KYC exchange ChangeNow before being swapped to ETH, he added. “The damage could have been far greater,” Unal said. “With replay protection nonfunctional, the attacker could have potentially drained additional approved accounts repeatedly.” *Decrypt* has reached out to TrustedVolumes for comment.
TrustedVolumes was hacked, resulting in a loss of approximately $6.7 million in funds due to vulnerabilities in its liquidity resolver.
The attacker exploited flaws in permissionless signer registration and replay protection, allowing them to drain funds without valid authorization.
The stolen assets included around 1,291 WETH, 206,282 USDT, 16.93 WBTC, and 1.26 million USDC.
1inch denied any involvement in the exploit, stating that its systems and user funds were unaffected, and emphasized that TrustedVolumes operates independently.

Bitcoin treasury executives identify a $3 trillion opportunity in digital credit, with the market already at $10 billion.

John Bollinger's model for Bitcoin turns positive, signaling potential price increases.

The White House aims for the Digital Asset Market Clarity Act to pass by July 4, 2026, with key votes scheduled in May and June. Patrick Witt expressed optimism about the timeline during Consensus Miami.

Cardano's Charles Hoskinson Celebrates Monero's Major Upgrade

Vitalik Buterin falls prey to a sandwich attack, unnoticed by many.

Morgan Stanley has launched crypto trading on ETrade, lowering fees as major cryptocurrencies drop.
See every story in Crypto — including breaking news and analysis.
DeFi aggregator 1inch pushed back after reports linked the platform directly to the breach, framing it as an attack on the protocol itself. “We can confirm that neither 1inch nor any of the 1inch protocols are involved,” 1inch tweeted. “There is no impact on 1inch systems, infrastructure or user funds.”
We are aware of misleading reports relating to an exploit involving TrustedVolumes. We can confirm that neither 1inch nor any of the 1inch protocols are involved.
There is no impact on 1inch systems, infrastructure or user funds.
TrustedVolumes operate independently as a…
— 1inch (@1inch) May 7, 2026 “From a vetting and monitoring perspective, we are working alongside our security partners to understand the specifics of how this exploit occurred, and we will be incorporating any relevant findings into our ongoing security and integration processes,” a 1inch spokesperson told *Decrypt*. If a provider is “unavailable or compromised, others continue to serve users without disruption,” with this “built-in redundancy” a core design principle that “functioned exactly as intended in this case,” the spokesperson added. “While it is true that 1inch uses TrustedVolumes as a resolver, we are one of many. The framing of this story is ultimately confusing and harmful,” 1inch co-founder Sergej Kunz tweeted.
“What’s striking about the TrustedVolumes incident is that the same attacker struck twice, months apart, against different contracts,” Nick Harris, founder and CEO of crypto asset recovery platform CryptoCare, told *Decrypt*, describing the perpetrator as a “patient, targeted operator” rather than an opportunistic hacker. He warned that surviving an exploit doesn’t necessarily close the risk but may instead “open a new one.” The TrustedVolumes exploit follows a brutal stretch for DeFi, with North Korean hackers draining $285 million from Drift Protocol and Kelp DAO losing $293 million in an attack it blamed on compromised LayerZero infrastructure. The Kelp hack has since spilled into a U.S. federal court, where Aave is fighting to unblock $71 million in frozen user funds on Arbitrum.