Transit Finance

2021-06-01

Transit Finance launches Transit Swap as a cross-chain DEX aggregator supporting Ethereum, BNB Chain, TRON, Polygon, and other networks.

2022-08-08

OFAC adds Tornado Cash to the Specially Designated Nationals list. The attacker in the upcoming Transit Finance exploit will use this sanctioned mixer two months later.

2022-10-02

Transit Finance (Transit Swap) suffers first major exploit. An attacker exploits an arbitrary external call vulnerability in the _claimTokens function, draining approximately $21–28.9 million in user-approved tokens across BNB Chain and Ethereum.

2022-10-03

PeckShield, SlowMist, Bitrace, TokenPocket, and CertiK collaborate to track the attacker via IP address, email, and on-chain identifiers. Attacker returns approximately $18.9 million (~70%) and sends 10,000 BNB (~$2M) to Tornado Cash as alleged bug bounty.

2022-10-06

Additional $246,000 recovered from the 2022 attacker per QuillAudits analysis.

2022-10-10

Attacker transfers 10,000 BNB ($2.74M) to victims and separately routes 2,500 BNB ($686K) to OFAC-sanctioned Tornado Cash.

2022-10-21

Transit Swap officially relaunches after a SlowMist security audit. Transit Finance establishes Transit Security Fund (10% of monthly revenue) and announces bug bounty program up to $1 million.

2024-12-01

U.S. Fifth Circuit Court of Appeals limits OFAC's sanctions authority over Tornado Cash's immutable smart contracts, beginning the process that leads to Tornado Cash delisting.

2025-04-01

U.S. Treasury delists Tornado Cash from OFAC sanctions following Fifth Circuit ruling.

2026-05-12

Attacker exploits a deprecated TRON-deployed legacy smart contract, draining approximately $1.875 million DAI plus ~1.37 ETH. Funds moved to a newly created Ethereum wallet. PeckShield detects and flags the breach.

2026-05-13

Transit Finance sends on-chain message to attacker offering bug bounty with 48-hour window. Project publicly commits to fully compensating affected users and states current contract version is unaffected. ZachXBT flags the incident.