Transit Swap Hack 2022 — $69M Exploit Analysis

An arbitrary call vulnerability in Transit Swap's contracts allowed attackers to steal $69M from user wallets.

Details

• Date: 2022-10-01
• Amount Lost: $69,000,000
• Chain(s): BSC, Ethereum, Polygon
• Category: DeFi
• Technique: Smart Contract Exploit
• Status: Partially Recovered
• Amount Recovered: $64,400,000

Full Description

Transit Swap's swap contract contained a function that allowed arbitrary external calls without proper validation. Attackers crafted calls to transfer tokens directly from users who had approved the Transit Swap contract, bypassing the intended swap functionality.

Laundering Analysis

Within 24 hours, the attacker (possibly white hat) returned approximately $64.4M (~70% of funds) after Transit Swap and on-chain investigators identified their IP address. Remaining funds moved through cross-chain bridges. Team offered 5% bounty.

Sources

• https://transitswap.medium.com/transit-swap-hacked-root-cause-analysis-b01b2f5b5cef
• https://rekt.news/transit-swap-rekt/

Transaction Hashes

• 0x181a7882aac0eab1036eedba25bc95a16e9e58b1d56e10d0f4d1d5a16f0c4c0

Related Hacks

• Euler Finance — 2023-03-13 — $197M
• Beanstalk Farms — 2022-04-17 — $182M
• Wintermute — 2022-09-20 — $160M
• Cream Finance — 2021-10-27 — $130M
• Compound — 2021-09-30 — $80M

Back to Browse