Transit Swap 2022 routing and approval exploit

Transit Swap routing exploit occurred2022-10-01

Attackers used an unchecked routing and permissions path to transfer assets from wallets that had approved the affected Transit Swap contract.

Transit Swap incident disclosed and traced2022-10-02

Transit Finance and security firms disclosed the incident, traced attacker addresses, and began communicating for asset return.

Main attacker returned approximately 70 percent2022-10-03

Security analysis and reporting stated that the main attacker returned approximately 70 percent of the initially reported stolen assets.

Swap and cross-chain services formally suspended2022-10-10

Transit Finance announced that swap and cross-chain swap services were suspended while technical upgrades continued.

Additional BNB returns reported2022-10-13

SlowMist's incident record reported additional BNB returns after an agreement with the principal attacker, while other actors and final reconciliation remained separate.

Transit Swap relaunched after contract replacement2022-10-21

Transit Finance restored swap and cross-chain functions after changing approval handling, whitelisting external calls, hardening bridge interactions, abolishing old-contract authority, publishing replacement contracts, and completing a SlowMist audit.