Blockchain security firm Blockaid has identified a connection between a recent decentralized finance exploit and the same threat actor responsible for the March 2025 attack on 1inch’s Fusion V1 resolver. While the two incidents share an operator, Blockaid emphasized that the underlying vulnerability exploited in the latest case differs from the one leveraged in the earlier breach. The finding raises pointed questions about how a single actor can repeatedly target high-profile DeFi protocols through distinct attack vectors.
What the Attribution Reveals About DeFi Threat Patterns
Linking separate exploits to a common operator is significant not because it suggests a single flaw, but because it points to a sophisticated adversary capable of identifying and weaponizing multiple vulnerabilities across different protocol architectures. Before diving into the strategic implications, it helps to frame what this means for the broader ecosystem.
- Repeat actor, new method: The operator behind the 1inch Fusion V1 exploit in March 2025 has now been tied to a separate incident exploiting an entirely different vulnerability, suggesting a well-resourced and adaptive threat profile.
- Protocol-specific risk: Each exploit targeted a distinct mechanism, which means patching one vulnerability did not neutralize the actor’s ability to strike elsewhere.
- DeFi protocols relying on post-incident remediation alone face compounding exposure when adversaries diversify their techniques.
- Security intelligence sharing between firms like Blockaid and protocol teams becomes more urgent when attribution data reveals persistent operators rather than one-off opportunists.
How the March 2025 1inch Fusion V1 Incident Unfolded
The earlier attack targeted 1inch’s Fusion V1 resolver infrastructure, a component responsible for executing optimized swap orders across decentralized exchanges. That breach exploited a specific vulnerability in the resolver’s logic, allowing the attacker to manipulate transaction execution in ways that drained value from the protocol. 1inch confirmed the incident at the time and moved to patch the affected resolver, migrating users toward updated versions of its swap architecture.
But here’s what makes the latest finding from Blockaid harder to dismiss as routine. The same operator didn’t simply reuse a known exploit. They found something new. That distinction matters enormously for how protocols model their threat environments.
A Different Vulnerability, a Familiar Adversary
Blockaid’s analysis confirmed that while the operator’s on-chain fingerprint matches across both incidents, the technical vulnerability exploited in the more recent case is structurally unrelated to the Fusion V1 flaw. This rules out the possibility that the second exploit was merely a derivative or residual effect of the first.
In practice, this means the actor likely conducted independent reconnaissance on a separate protocol or contract surface, identified a novel weakness, and executed against it. The operational sophistication implied here goes beyond what most DeFi security models are designed to anticipate (a distinction that arguably separates opportunistic hackers from what threat intelligence professionals would classify as a persistent operator).
Whether additional protocols have been probed by this same entity remains an open thread.
Why Attribution Matters More Than the Exploit Itself
Security firms routinely publish post-mortems on DeFi exploits. What makes Blockaid’s disclosure different is the emphasis on operator-level attribution rather than just vulnerability classification. Most incident reports focus on the “how.” This one foregrounds the “who” — and that shift in framing carries real strategic weight.
When an exploit is treated as an isolated technical failure, the response is typically a patch. When it’s attributed to a persistent actor, the response needs to be broader: ongoing monitoring, behavioral analysis of on-chain patterns, and preemptive auditing of adjacent attack surfaces. The difference between those two postures can determine whether a protocol loses funds once or repeatedly.
Implications for Protocol Security Teams
| Factor | Isolated Exploit Response | Persistent Operator Response |
|---|---|---|
| Scope of remediation | Patch specific vulnerability | Audit broader attack surface and monitor for behavioral signatures |
| Intelligence sharing | Optional, post-incident | Critical and ongoing across ecosystem partners |
| Threat modeling | Reactive | Proactive, assumes adversary will adapt and return |
| Resource allocation | Engineering-focused | Requires dedicated security operations capacity beyond just code review |
The Broader DeFi Security Landscape in 2025
This year has already seen a sharp escalation in both the frequency and sophistication of DeFi exploits. Cross-chain bridges, resolver mechanisms, and oracle dependencies have all been targeted with increasing precision. And while total value locked across DeFi protocols has recovered from its 2022–2023 lows, the security infrastructure protecting that capital has not scaled proportionally.
Blockaid’s threat detection platform represents one layer of a defense ecosystem that still lacks standardization. No universal framework exists for sharing operator-level attribution data across protocols in real time. Some teams operate with dedicated security partners; many do not. The gap between well-defended protocols and vulnerable ones continues to widen.
Still, the fact that attribution is happening at all — and being published — signals a maturation in how the industry treats security intelligence. Five years ago, most exploits were analyzed in isolation. Today, firms are building adversary profiles.
Frequently Asked Questions
Was the same vulnerability exploited in both incidents?
No. Blockaid confirmed the latest exploit stems from a different vulnerability than the one used in the March 2025 1inch Fusion V1 attack. The connection is the operator, not the technical flaw.
What is operator-level attribution in blockchain security?
It refers to linking multiple on-chain incidents to a single entity based on behavioral patterns, wallet interactions, and execution signatures rather than just analyzing the vulnerability itself. Think of it as profiling the actor behind the attack, not just cataloging the weapon used.
Does this affect 1inch users today?
The March 2025 vulnerability in Fusion V1 was addressed by the 1inch team at the time. The latest exploit involves a separate vulnerability on a different surface. Users should monitor official channels for any protocol-specific advisories.
How can DeFi protocols defend against persistent operators?
Beyond patching known flaws, protocols need continuous monitoring, adversary-aware threat modeling, and active participation in cross-ecosystem intelligence sharing. A single audit is not enough when the adversary adapts between attacks.
