Transit Finance Swap Exploit Thefts

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Transit Swap Website

A hacker exploited a vulnerability in cross-chain DeFi platform Transit Finance, stealing $28.9 million. The hacker transferred 2,500 BNB tokens ($686,000) to Tornado Cash, a sanctioned privacy protocol. The hacker agreed to return 10,000 BNB ($2.74 million) to victims of the exploit. Security firms helped trace the hacker's IP address, leading to the return of $18.9 million. Transit Swap, the DEX affected, has received 70% of stolen funds back, with white hat hackers returning $24 million. Some funds were destroyed and irrecoverable. TransitFinance has taken responsibility for users' losses and will facilitate refunds and certificates for affected users. Additional rewards are also being offered to users waiting for refunds.

This is a global/international case not involving a specific country.

About Transit Finance

Transit Swap proposes a novel approach to decentralized exchanges, promising improved liquidity and returns through a unified platform for trading across various chains. By integrating popular DEXs from multiple public chains, Transit Swap intelligently combines their strengths to enhance transaction depth and yield desired tokens. The platform eliminates the need to select specific DEXs for trading, streamlining multi-chain transactions, deepening liquidity, and enhancing prices. Additionally, Transit Swap employs smart strategies to ensure safer cross-chain transactions and optimal transaction prices. It simplifies asset transfers across multiple chains, eliminating cross-chain complexities.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

"On Friday last week, the hacker capitalized on an exploit on Transit Swap's swap contract, which typically facilitates the exchange of assets."

Key Event Timeline - Transit Finance Swap Exploit Thefts

Date	Event	Description
October 1st, 2022 12:33:00 PM MDT	Time Attributed To Attack	Transit Finance reports this as the time of the attack.
October 1st, 2022 12:34:15 PM MDT	First Successful Attack	The first successful attack happens on BSC.
October 3rd, 2022 9:00:00 AM MDT	CoinDesk Refund Article	Article on CoinDesk about the refund.
October 10th, 2022 12:14:16 PM MDT	Funds Returned	The attacker returns some of the stolen funds (6500 BNB).
October 12th, 2022 9:20:07 AM MDT	Transit Finance Medium Post	Transit Finance reports that their efforts have recovered $24 million, while $4.9 million remains unrefunded due to permanent losses and judicial processes. The company will refund users 82.9% of their losses through a multi-step plan, including returning 14.9% of losses immediately and issuing certificates (TS) for the remaining 17.1% on October 14th. On October 19th, TransitFinance will allow users to exchange certificates (TS) for USDT at a ratio of 1:1 and repurchase 1 million certificates (TS). The remaining certificates (TS) will be exchanged monthly with an added 3% reward. Starting November 15th, 50% of the previous month's TransitSwap income will be used to exchange certificates (TS) until all are exchanged. The recovery of additional hacked funds may expedite this process. Users are advised to rely on official channels and avoid sharing sensitive information.
October 13th, 2022 1:01:01 AM MDT	Funds Returned	The attacker returns some of the stolen funds.
October 13th, 2022 10:24:17 PM MDT	Transit Finance Medium Post	Transit Finance announces that they have "closed the service for users to apply to change the claim address. For users who have already applied and have not been changed yet, please check your email and reply to us". Those who have already applied and not received a change are requested to check their email and respond. A list of affected users is provided, and those on the list are urged to contact the company promptly to avoid delays in the refund process. The company also warns of scams exploiting the situation and emphasizes getting information solely from official channels. Users are also advised against sharing private keys or mnemonics with others.
October 14th, 2022	Slowmist Audit Completed	Transit Finance completes an audit via the SlowMist team.
October 21st, 2022	Transit Finance Relaunch	The service relaunches with a blog post.
May 26th, 2023	Slowmist Audit Completed	Transit Finance completes an audit of their new version 5 smart contract via the SlowMist team.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

TransitFinance has suffered a hacker attack resulting in a loss of $28.9 million. Efforts have recovered $24 million, while $4.9 million remains unrefunded due to permanent losses and judicial processes. The company will refund users 82.9% of their losses through a multi-step plan, including returning 14.9% of losses immediately and issuing certificates (TS) for the remaining 17.1% on October 14th. On October 19th, TransitFinance will allow users to exchange certificates (TS) for USDT at a ratio of 1:1 and repurchase 1 million certificates (TS). The remaining certificates (TS) will be exchanged monthly with an added 3% reward. Starting November 15th, 50% of the previous month's TransitSwap income will be used to exchange certificates (TS) until all are exchanged. The recovery of additional hacked funds may expedite this process. Users are advised to rely on official channels and avoid sharing sensitive information.

Total Amount Lost

The total amount lost has been estimated at $28,690,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

A large portion of the lost funds were returned to the protocol.

A hacker that stole $28.9 million from cross-bridge DeFi platform Transit Finance transferred 2,500 BNB tokens ($686,000) to sanctioned privacy protocol Tornado Cash. The hacker also reportedly agreed to return 10,000 BNB ($2.74 million) to victims of the exploit.

"Transit Swap said that $18.9 million has been returned after a slew of security firms helped triangulate the hacker's IP address."

"Transit Swap, a cross-chain decentralized exchange (DEX), has received 70% of stolen funds back from a hacker that exploited a smart contract vulnerability."

"Up to now, white hats have returned funds worth $24M, and funds worth $4.9M remained unrefunded (144,000 USDT worth of funds were sent into the blackhole by hacker#1 and permanently destroyed, and 1.4 million USDT worth of funds were lost when hacked#1 swap USDT to BNB and cannot be recovered forever)."

"With a responsible attitude towards users’ assets, TransitFinance Official will bear 100% of users’ losses"

"On October 14th, users can visit the refund website to claim the second batch of refunds and certificates(TS)."

"The remaining 3.94 million certificates(TS) will be exchanged monthly, and TransitFinance Official will give users an additional 3% as a waiting reward."

SlowMist Auditing Completed

"The SlowMist security team used a manual and SlowMist team's analysis tool for auditing the project, during the audit work we found 1 high risk, 1 medium risk, and 6 suggestion vulnerabilities. 1 high risk and 1 medium risk have been fixed; 1 suggestion vulnerability was ignored; All other findings were confirmed. The code has been deployed to the mainnet."

Total Amount Recovered

https://etherscan.io/tx/0x3da1843247070fbcfcf9c8d0e02dcd660ea882640fc842625b675aabc45e6a2a is the second refund returned.

A hacker that stole $28.9 million from cross-bridge DeFi platform Transit Finance transferred 2,500 BNB tokens ($686,000) to sanctioned privacy protocol Tornado Cash. The hacker also reportedly agreed to return 10,000 BNB ($2.74 million) to victims of the exploit.

"Transit Swap said that $18.9 million has been returned after a slew of security firms helped triangulate the hacker's IP address."

"Transit Swap, a cross-chain decentralized exchange (DEX), has received 70% of stolen funds back from a hacker that exploited a smart contract vulnerability."

"Up to now, white hats have returned funds worth $24M, and funds worth $4.9M remained unrefunded (144,000 USDT worth of funds were sent into the blackhole by hacker#1 and permanently destroyed, and 1.4 million USDT worth of funds were lost when hacked#1 swap USDT to BNB and cannot be recovered forever)."

"With a responsible attitude towards users’ assets, TransitFinance Official will bear 100% of users’ losses"

"On October 14th, users can visit the refund website to claim the second batch of refunds and certificates(TS)."

"The remaining 3.94 million certificates(TS) will be exchanged monthly, and TransitFinance Official will give users an additional 3% as a waiting reward."

Challenges With Changed Claim Addresses

Several users who lost funds in Transit Finance requested to change their claim address. Initially, Transit Finance was honouring these requests, however they later stopped offering this service. The company warned of scams exploiting the situation and emphasizes getting information solely from official channels.

The total amount recovered has been estimated at $24,000,000 USD.

Ongoing Developments

TransitSwap continues to operate. They have obtained smart contract auditing on their newer versions of their protocol.

Getting Regular Audits

The TransitSwap again obtained an audit for the launch of their version 5 of their contract.

Individual Prevention Policies

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The original TransitSwap platform was not audited. The issue could have been prevented through obtaining a third party smart contract audit.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

In general, a better design limits the amount of funds which can be taken without multi-signature approval by human operators. The amount of funds in the hot wallet would be adjusted based on activity and larger swaps would be processed manually.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

In this case, funds were returned by many of the attackers, leaving only a small portion to be covered by the project team. Setting up a treasury of funds to assist users with recovery would ensure that there was no risk of users not being made whole in a similar situation.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Ensuring that platforms obtain smart contract audits prior to launching would have prevented this situation.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Setting up an industry insurance fund would ensure that users were made whole in similar situations.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.