The attack targeted a custom RFQ swap proxy controlled by TrustedVolumes, a DeFi market maker and official resolver on 1inch Fusion, responsible for filling gasless swap orders and providing liquidity across the protocol.

The exploit drained 1,291.16 WETH, 206,282 USDT, 16.939 WBTC, and 1,268,771 USDC from the affected contract.