Skip to main content
Sign in

Transit Finance

avoid.net/transit-finance→2/100·83% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2Mdox6…3sZJ

Summary

Transit Finance (also known as Transit Swap) is a cross-chain DEX aggregator supporting over 122 decentralized exchanges across Ethereum, BNB Chain, TRON, Solana, Polygon, and other networks. The protocol has suffered two confirmed security exploits: a $28.9 million hack in October 2022 due to an arbitrary external call vulnerability in its routing contract, with approximately $18.9 million recovered; and a second $1.88 million exploit in May 2026 via a deprecated TRON smart contract that remained on-chain and exploitable years after official deprecation. ZachXBT flagged the protocol amid broader DeFi monitoring, and the 2022 attacker routed funds through OFAC-sanctioned Tornado Cash.

Connected Entities

1 entities
Protocols
⌂Transit Finance
Relationships
  • + 2 more
Have evidence about Transit Finance?
1
Accepted
0
Under review
0
Rejected / revoked

Community submissions

  • AcceptedincriminatingWayback pending5/29/2026, 2:39:23 AM

    “CryptoTimes report on the May 13, 2026 Transit Finance hack documenting the $1.88M DAI drain via a deprecated 2022 TRON contract — the protocol's second major exploit.”

    — avoid-scout

Timeline(11 events)

June 2021

Transit Finance launches Transit Swap as a cross-chain DEX aggregator supporting Ethereum, BNB Chain, TRON, Polygon, and other networks.

8 August 2022

OFAC adds Tornado Cash to the Specially Designated Nationals list. The attacker in the upcoming Transit Finance exploit will use this sanctioned mixer two months later.

2 October 2022

Transit Finance (Transit Swap) suffers first major exploit. An attacker exploits an arbitrary external call vulnerability in the _claimTokens function, draining approximately $21–28.9 million in user-approved tokens across BNB Chain and Ethereum.

3 October 2022

PeckShield, SlowMist, Bitrace, TokenPocket, and CertiK collaborate to track the attacker via IP address, email, and on-chain identifiers. Attacker returns approximately $18.9 million (~70%) and sends 10,000 BNB (~$2M) to Tornado Cash as alleged bug bounty.

6 October 2022

Additional $246,000 recovered from the 2022 attacker per QuillAudits analysis.

10 October 2022

Attacker transfers 10,000 BNB ($2.74M) to victims and separately routes 2,500 BNB ($686K) to OFAC-sanctioned Tornado Cash.

21 October 2022

Transit Swap officially relaunches after a SlowMist security audit. Transit Finance establishes Transit Security Fund (10% of monthly revenue) and announces bug bounty program up to $1 million.

December 2024

U.S. Fifth Circuit Court of Appeals limits OFAC's sanctions authority over Tornado Cash's immutable smart contracts, beginning the process that leads to Tornado Cash delisting.

April 2025

U.S. Treasury delists Tornado Cash from OFAC sanctions following Fifth Circuit ruling.

12 May 2026

Attacker exploits a deprecated TRON-deployed legacy smart contract, draining approximately $1.875 million DAI plus ~1.37 ETH. Funds moved to a newly created Ethereum wallet. PeckShield detects and flags the breach.

13 May 2026

Transit Finance sends on-chain message to attacker offering bug bounty with 48-hour window. Project publicly commits to fully compensating affected users and states current contract version is unaffected. ZachXBT flags the incident.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain17 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (5 events). 17 of 24 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 5/28/2026, 3:37:52 AM

last updated: 9/1/2026, 10:08:38 AM

avoid.net — verified advice for a post-truth world