Transit Swap Hack

Reported loss $28.9M
BNB Chain Ethereum
Transfer Logic Exploit

What happened

Transit Swap was exploited on October 2, 2022 after a vulnerability in its Cross Approve Proxy allowed an attacker to drain approved assets from user wallets. CertiK reported transfers of about 49,815 BNB and 5,182 ETH before the contracts were paused.

Technical root cause

The Cross Approve Proxy insufficiently validated user-controlled transfer inputs, allowing unauthorized transferFrom operations against approved wallets. Revoking unused approvals was therefore an important containment step for previously interacting users.

How it happened

  1. Users had granted token approvals to Transit Swap.
  2. The attacker supplied crafted inputs to the Cross Approve Proxy.
  3. The proxy failed to constrain the transfer target and parameters, allowing unauthorized transferFrom calls.
  4. The attacker drained approved wallets and routed proceeds across chains; no stolen user private key is required by the published analysis.

Protocol details

Classification Protocol Logic / Input Validation / Exchange (DEX)
Protocol Type Exploit/Other
Implementation language Solidity
Protocol links Website @TransitFinance

Funds Recovery

66.2%

Recovered

$19.1M

Net Loss

$9,768,200

Post-Incident Timeline

  • 2022-10-11

    240,000 $USD was fully recovered from 4th hacker with the help of BlockSec

Evidence

Proof of concept

1 available

Sources

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes