Transit Swap Hack

Transit Swap, run by Transit Finance, is a DEX aggregator that finds the best swap routes across many blockchains. To trade through it, users approved its contracts to spend their tokens. In early October 2022, an attacker discovered that one of these contracts would move approved tokens for anyone who asked, without checking whether the request came from the tokens' owner. The attacker used this to drain tokens from wallets that had approved Transit Swap on Ethereum and BNB Chain, taking about $24M in a short time.

Transit Swap paused the affected contracts and worked with PeckShield, SlowMist, Bitrace and TokenPocket, which traced the attacker's IP address, email address and wallets. As the investigation closed in, the attacker returned around $18M within days. Transit Swap then paid the recovered funds back to victims through a dedicated refund contract. The remaining $5M or so was never recovered. Early news reports gave different totals for the amount stolen and returned, but most agreed that roughly 70% came back.

The contracts were never repaired. Transit Swap only switched them off by clearing their settings, and they are still controlled by a regular wallet that could switch them back on at any time. That means approvals to them still carry risk. If you ever approved the Transit Swap contracts listed here on Ethereum or BNB Chain, revoke those approvals. Revoking protects what is still in your wallet, but it does not recover funds that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.