Transit Swap Incident Report

Transit Swap, a cross-chain swap/DEX aggregator, was actively exploited via its Transit Swap&Cross Approve Proxy contract allowing an attacker to drain hundreds of user wallets and steal approximately 49,815 BNB and 5,182 ETH; the attacker bridged ETH to BNB Chain and used Tornado Cash deposits to launder funds. Transit paused its contracts and advised users who approved the proxy to move funds to addresses with no prior interaction with the platform.