1Inch Hack

On March 6, 2025, 1inch’s Fusion v1 Settlement Contract suffered a $2.6 million exploit, losing approximately $1.2 million in USDC and 638 ETH. The root cause was a re-entrancy vulnerability in the fillOrderInteraction() function, which allowed attackers to repeatedly gain approvals for asset transfers.

The exploited function, fillOrderInteraction(), blindly accepted user-supplied input (takingAmount) and returned that value as the approved transfer amount. This function is part of the 1inch Aggregation Router (0x11111112…960582), which called fillOrderTo(). Critically, both functions accepted arbitrary calldata, opening the door to a re-entrancy attack.

This re-entrancy flaw enabled multiple fraudulent approvals, allowing the attacker to withdraw funds far beyond legitimate order amounts.

Exploit TX Example:

https://etherscan.io/tx/0xb5c94efa…ce1c60