Refreshed 5h ago· updates every 6h

Transit Swap (2022) — Crypto Hack

Partially Recovered

Oct 1, 2022·

BSCEthereumPolygon

Amount Stolen

$69.0M

Various tokens

Recovered

$64.4M

93% of stolen funds

An arbitrary call vulnerability in Transit Swap's contracts allowed attackers to steal $69M from user wallets.

Summary

An arbitrary call vulnerability in Transit Swap's contracts allowed attackers to steal $69M from user wallets.

How It Was Compromised — DeFi via Smart Contract Exploit

DeFiSmart Contract Exploit

Transit Swap's swap contract contained a function that allowed arbitrary external calls without proper validation. Attackers crafted calls to transfer tokens directly from users who had approved the Transit Swap contract, bypassing the intended swap functionality.

Fund Flow & Laundering Analysis

Within 24 hours, the attacker (possibly white hat) returned approximately $64.4M (~70% of funds) after Transit Swap and on-chain investigators identified their IP address. Remaining funds moved through cross-chain bridges. Team offered 5% bounty.