$5M Exploit Hits Resolvers Using Outdated 1inch Contracts

Crypto News Exploits

Written by Aaron S.,

Editor-In-Chief

Last Updated: March 10, 2025

Key Takeaways

A $5M exploit targeted third-party resolvers using an outdated 1inch Settlement v1 contract;
To prevent similar incidents, impacted parties were urged to update contracts;
A bug bounty resolution was reached between the affected resolvers and the hacker.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

$5M Exploit Hits Resolvers Using Outdated 1inch Contracts

BITDEGREE IN YOUR SOCIAL FEED

A security flaw in an outdated contract allowed an attacker to steal $5 million from resolvers—third-party entities executing trades—interacting with 1inch’s 1INCH $0.1632 Fusion protocol.

The vulnerability stemmed from the deprecated 1inch Settlement v1 contract, which had already been phased out. However, some resolvers continued using it without additional security measures.

1inch detected the vulnerability on March 5 and publicly disclosed the problem in a March 6 post on X.

What Are Oracles in Crypto? (Beginner Friendly Animation)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

By March 7, SlowMist, a blockchain security firm, confirmed in a post on X, "According to our analysis, this incident resulted in a loss of 2.4 million USD Coin USDC $0.9990 and 1276 Wrapped Ethereum WETH $2,929.86 , totaling over $5 million".

The affected resolvers have since reached a bug bounty resolution with the hacker.

1inch assured that individual users’ assets remained untouched: "No end-user funds were at risk—only resolvers using Fusion v1 in their own contracts."

In response to the incident, the platform urged all resolvers to review and update their contracts:

We’re actively working with affected resolvers to secure their systems. We urge all resolvers to audit and update their contracts immediately.

To prevent similar exploits, 1inch introduced bug bounty programs to identify security gaps and explore ways to recover the stolen assets.

On February 12, zkLend, a decentralized lending protocol on Starknet, lost $4.9 million in a security breach. How did hackers pull it off? Read the full story.