Transit Finance (2026) — Crypto Hack
Not Recovered$1.8M in DAI drained from Transit Finance cross-chain swap aggregator; funds traced to a single Ethereum address by PeckShield. Repeat hack of same protocol (previously hit in Oct 2022 for $28.9M).
Summary
$1.8M in DAI drained from Transit Finance cross-chain swap aggregator; funds traced to a single Ethereum address by PeckShield. Repeat hack of same protocol (previously hit in Oct 2022 for $28.9M).
How It Was Compromised — Smart Contract Exploit via Attack vector not fully disclosed. PeckShield traced stolen $1.88M DAI to a single Ethereum address. Transit Finance was previously exploited in October 2022 for $28.9M, making this a repeat attack on the same protocol.
On May 13 2026, Transit Finance — a cross-chain swap aggregator — suffered its second major exploit, with $1.8M in DAI drained from the protocol. The exact attack vector has not been fully disclosed by the project team. PeckShield security researchers identified and traced the stolen $1.88M DAI to a single Ethereum wallet address. This is a repeat incident for Transit Finance, which was previously hacked in October 2022 for $28.9M in a token approval exploit. The recurrence suggests insufficient remediation of approval-based vulnerabilities following the 2022 incident.
Fund Flow & Laundering Analysis
Stolen DAI remains in an identified Ethereum wallet address as of reporting date. PeckShield's on-chain tracing successfully identified the destination wallet, but no recovery or freezing action has been confirmed. The stolen funds have not been converted to ETH or moved through mixers as of last update.