Trusted Volumes attacker returns 1

An attacker behind the Trusted Volumes exploit returned 1,122 ETH to the affected party while keeping roughly $2 million of the drained funds, an outcome that on-chain trackers have described as a de facto bounty settlement.

The partial return was flagged by DefimonAlerts on X, which tracked the movement of funds back toward the exploited party after the incident. The alert framed the event as a post-attack development rather than a fresh exploit. For related coverage, see Hyperliquid Co-Founder Says Crypto Struggles to Attract Top Talent.

On-chain records show the attacker-linked address sending Ethereum back in the hours following the incident, with the returned 1,122 ETH visible in the address activity. The remaining balance stayed with the attacker. For related coverage, see Strategy's U.S. Dollar Reserves Near $3B, Filing Shows.

The Retained Funds Are Being Treated as a Bounty

The portion the attacker kept, valued at about $2 million, is being characterized as a bounty rather than a formal reward agreed in advance. That label reflects how the outcome has been described by trackers, not a confirmed contractual arrangement between the parties. For related coverage, see Ondo-Linked Address Sends 26.05M ONDO to Coinbase Worth $9.79M.

The distinction matters. In post-exploit situations, a partial return often signals a negotiated or unilateral settlement in which the attacker returns most funds and retains a slice, blurring the line between a white-hat recovery and an attacker keeping proceeds. For related coverage, see Bank of America Appoints Head of Digital Assets and AI to Advance Crypto Strategy.

Transactions tied to the movement can be traced through Etherscan, including the recorded transfers associated with the address. Readers can verify the sender, receiver, and timing directly on the explorer rather than relying on secondary summaries.

What the Exploit Involved

A technical breakdown of the incident was published by Verichains in its TrustedVolumes exploit analysis, which examined how the attack unfolded. That analysis is the most detailed public account of the mechanics available at the time of writing.

Because the funds moved on Ethereum, the event sits squarely within the attention of ETH-focused observers who track protocol security and fund recoveries. That is the same audience following broader Ethereum activity, from spot ETF flows to on-chain movements.

Open Questions After the Return

The return of most of the funds does not by itself resolve the incident. Outstanding issues include the total loss figure, the terms under which funds were returned, and whether Trusted Volumes will publish a formal post-mortem.

Watchers should look for an official statement from the affected party, confirmation of remediation steps, and clarity on how the retained amount is ultimately classified. Until then, the bounty framing remains a description applied by trackers rather than a settled fact.

FAQ

How much ETH was returned? On-chain trackers reported 1,122 ETH sent back to the affected party after the exploit.

Why did the attacker keep about $2 million? The retained funds have been described as a bounty in reporting on the return, though no formal reward agreement has been confirmed in the available evidence.

Is the issue resolved? Not fully. The partial return leaves open questions around total losses, disclosure, and remediation that Trusted Volumes has yet to publicly address.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.