{"investigation":{"slug":"transit-finance","entity_name":"Transit Finance","trust_score":2,"severity_base":null,"score_modifier":-20,"confidence":0.83,"status":"published","content_type":"investigation","summary":"Transit Finance (also known as Transit Swap) is a cross-chain DEX aggregator supporting over 122 decentralized exchanges across Ethereum, BNB Chain, TRON, Solana, Polygon, and other networks. The protocol has suffered two confirmed security exploits: a $28.9 million hack in October 2022 due to an arbitrary external call vulnerability in its routing contract, with approximately $18.9 million recovered; and a second $1.88 million exploit in May 2026 via a deprecated TRON smart contract that remained on-chain and exploitable years after official deprecation. ZachXBT flagged the protocol amid broader DeFi monitoring, and the 2022 attacker routed funds through OFAC-sanctioned Tornado Cash.","sections":[{"content":"","heading":"","sources":[{"url":"","name":"https://docs.transit.finance/","type":"other","credibility":3},{"url":"","name":"https://iq.wiki/wiki/transit-finance","type":"other","credibility":3},{"url":"","name":"https://skynet.certik.com/projects/transit-swap","type":"other","credibility":3}],"severity":"medium"},{"content":"","heading":"","sources":[{"url":"","name":"https://www.bankinfosecurity.com/hacker-steals-29m-from-transit-finance-returns-19m-a-20196","type":"other","credibility":3},{"url":"","name":"https://www.coindesk.com/business/2022/10/03/transit-swap-exploiter-returns-large-chunk-of-289m-hack","type":"other","credibility":3},{"url":"","name":"https://www.coindesk.com/business/2022/10/10/transit-finance-hacker-returns-274m-to-victims-sends-686k-to-tornado-cash","type":"other","credibility":3},{"url":"","name":"https://quillaudits.medium.com/transit-finance-28-9m-exploit-analysis-quillaudits-5d8228956102","type":"other","credibility":3},{"url":"","name":"https://slowmist.medium.com/cross-chain-dex-aggregator-transit-swap-hacked-analysis-74ba39c22020","type":"other","credibility":3},{"url":"","name":"https://www.halborn.com/blog/post/explained-the-transit-swap-hack-october-2022","type":"other","credibility":3},{"url":"","name":"https://medium.com/neptune-mutual/decoding-transit-finances-contract-vulnerability-977d2fda2897","type":"other","credibility":3},{"url":"","name":"https://beincrypto.com/hacker-exploits-21m-vulnerability-in-transit-swap/","type":"other","credibility":3}],"severity":"medium"},{"content":"","heading":"","sources":[{"url":"","name":"https://www.coindesk.com/business/2022/10/10/transit-finance-hacker-returns-274m-to-victims-sends-686k-to-tornado-cash","type":"other","credibility":3},{"url":"","name":"https://www.bankinfosecurity.com/hacker-steals-29m-from-transit-finance-returns-19m-a-20196","type":"other","credibility":3},{"url":"","name":"https://home.treasury.gov/news/press-releases/jy0916","type":"other","credibility":3}],"severity":"medium"},{"content":"","heading":"","sources":[{"url":"","name":"https://docs.transit.finance/announcement/announcement/relaunch","type":"other","credibility":3},{"url":"","name":"https://medium.com/@TransitSwap/transit-swap-is-officially-re-launch-abe58f242d28","type":"other","credibility":3},{"url":"","name":"https://skynet.certik.com/projects/transit-swap","type":"other","credibility":3},{"url":"","name":"https://www.slowmist.com/en/security-audit-certificate.html?id=928799684ad96ef4ed4b0c0fb12a5fae085456f874b19dc4300195b32a5a1431","type":"other","credibility":3}],"severity":"medium"},{"content":"","heading":"","sources":[{"url":"","name":"https://crypto.news/transit-finance-hack-drains-1-88m-from-cross-chain-protocol/","type":"other","credibility":3},{"url":"","name":"https://www.web3isgoinggreat.com/single/transit-finance-hack","type":"other","credibility":3},{"url":"","name":"https://www.ainvest.com/news/transit-finance-hack-1-88m-stablecoin-drain-flow-implications-2605/","type":"other","credibility":3},{"url":"","name":"https://nulltx.com/1-88m-reportedly-drained-in-transitfinance-exploit-that-exposes-hidden-risks-of-legacy-smart-contracts/","type":"other","credibility":3},{"url":"","name":"https://www.cryptotimes.io/2026/05/13/1-88m-drained-from-transit-finance-stolen-dai-sits-in-fresh-eth-wallet/","type":"other","credibility":3},{"url":"","name":"https://cryip.co/transit-finance-hacked-again-cross-chain-defi-protocol-loses-1-88-million-in-latest-exploit/","type":"other","credibility":3},{"url":"","name":"https://phemex.com/news/article/transit-finance-to-compensate-users-after-tron-smart-contract-exploit-80916","type":"other","credibility":3},{"url":"","name":"https://www.cryptopolitan.com/transit-finance-to-refund-hack-may-losses/","type":"other","credibility":3}],"severity":"medium"},{"content":"","heading":"","sources":[{"url":"","name":"https://skynet.certik.com/projects/transit-swap","type":"other","credibility":3},{"url":"","name":"https://www.halborn.com/blog/post/explained-the-transit-swap-hack-october-2022","type":"other","credibility":3},{"url":"","name":"https://blog.solidityscan.com/transit-swap-hack-analysis-13c1e04e7de0/","type":"other","credibility":3},{"url":"","name":"https://nulltx.com/1-88m-reportedly-drained-in-transitfinance-exploit-that-exposes-hidden-risks-of-legacy-smart-contracts/","type":"other","credibility":3},{"url":"","name":"https://medium.com/neptune-mutual/decoding-transit-finances-contract-vulnerability-977d2fda2897","type":"other","credibility":3}],"severity":"medium"},{"content":"","heading":"","sources":[{"url":"","name":"https://www.bankinfosecurity.com/hacker-steals-29m-from-transit-finance-returns-19m-a-20196","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-06-01","event":"Transit Finance launches Transit Swap as a cross-chain DEX aggregator supporting Ethereum, BNB Chain, TRON, Polygon, and other networks.","source":""},{"date":"2022-08-08","event":"OFAC adds Tornado Cash to the Specially Designated Nationals list. The attacker in the upcoming Transit Finance exploit will use this sanctioned mixer two months later.","source":""},{"date":"2022-10-02","event":"Transit Finance (Transit Swap) suffers first major exploit. An attacker exploits an arbitrary external call vulnerability in the _claimTokens function, draining approximately $21–28.9 million in user-approved tokens across BNB Chain and Ethereum.","source":""},{"date":"2022-10-03","event":"PeckShield, SlowMist, Bitrace, TokenPocket, and CertiK collaborate to track the attacker via IP address, email, and on-chain identifiers. Attacker returns approximately $18.9 million (~70%) and sends 10,000 BNB (~$2M) to Tornado Cash as alleged bug bounty.","source":""},{"date":"2022-10-06","event":"Additional $246,000 recovered from the 2022 attacker per QuillAudits analysis.","source":""},{"date":"2022-10-10","event":"Attacker transfers 10,000 BNB ($2.74M) to victims and separately routes 2,500 BNB ($686K) to OFAC-sanctioned Tornado Cash.","source":""},{"date":"2022-10-21","event":"Transit Swap officially relaunches after a SlowMist security audit. Transit Finance establishes Transit Security Fund (10% of monthly revenue) and announces bug bounty program up to $1 million.","source":""},{"date":"2024-12-01","event":"U.S. Fifth Circuit Court of Appeals limits OFAC's sanctions authority over Tornado Cash's immutable smart contracts, beginning the process that leads to Tornado Cash delisting.","source":""},{"date":"2025-04-01","event":"U.S. Treasury delists Tornado Cash from OFAC sanctions following Fifth Circuit ruling.","source":""},{"date":"2026-05-12","event":"Attacker exploits a deprecated TRON-deployed legacy smart contract, draining approximately $1.875 million DAI plus ~1.37 ETH. Funds moved to a newly created Ethereum wallet. PeckShield detects and flags the breach.","source":""},{"date":"2026-05-13","event":"Transit Finance sends on-chain message to attacker offering bug bounty with 48-hour window. Project publicly commits to fully compensating affected users and states current contract version is unaffected. ZachXBT flags the incident.","source":""}],"sources_used":[],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-28T03:37:52.029657+00:00","updated_at":"2026-05-30T19:10:18.559+00:00"}}