Transit Swap Hack

Transit Swap exchange was hacked due to the smart contract vulnerability. The hacker stole 28,900,000 $USD from users who approved their assets to Transit Swap. 65% of the stolen funds were recovered by the joint effort of the security teams.

Transit Swap is a multichain DEX, running on both Ethereum and Binance chains. The project was exploited by a hacker, and roughly 28,900,000 $USD worth of assets were stolen from user's addresses. The hacker deployed malicious smart contracts to exploit the swap contracts of the project on both chains. Due to the vulnerability of the swap contracts, which allows the hacker to use transferFrom() function to drain the user's approved assets and transfer them to another EOA address.

Within 24 hours after the hack, Transit Finance announced about the recovery of 65% of stolen funds in collaboration with other security teams. And consequently, Transit Finance published an article with a list of addresses involved in the hack and said that the total recovered funds are from the hacker involved in the attack with the largest amount, and the team is working on recovering the remaining stolen funds and formulating Bug Bounty rules.

Attacker address:

https://bscscan.com/address/0x5f0b31aa…98fbef

https://etherscan.io/address/0x5f0b31aa…98fbef

Address funds transferred:

https://bscscan.com/address/0x75f2aba6…bffd46

https://etherscan.io/address/0x75f2aba6…bffd46

Malicious contracts:

https://bscscan.com/address/0x8ca8fd9c…c68a34

https://etherscan.io/address/0x17ff6c94…f204ea

Recovering transactions:

https://etherscan.io/tx/0x3da18432…5e6a2a

https://bscscan.com/tx/0xd941c601…9c5f83

https://bscscan.com/tx/0x53495bd2…474e02