“Transit Swap, a multi-chain decentralized exchange (DEX) aggregator, lost roughly $21 million after a hacker exploited an internal bug on a swap contract” [Sarkar, A. Transit Swap loses over $21M due to code bug exploit, issues apology. (Accessed October 2, 2022)].
"The multi-chain DEX announced this on Twitter while also apologizing for the exploit. ‘After a self-review by the TransitFinance team, it was confirmed that the incident was caused by a hacker attack due to a bug in the code. We are deeply sorry,’ it said [Adejumo, O. Hacker Exploits $21M Vulnerability in Transit Swap. (Accessed October 2, 2022)].
.png)
“Blockchain investigator Peckshield narrowed down the attack to a compatibility issue or misplaced trust in the swap contract” [Sarkar, supra]. Peckshield has shared it’s flowchart depicting movement of the stolen Transit Swap assets as follows:
In it’s announcement Transit Swap pledged:
We now have a lot of valid information such as the hacker’s IP, email address, and associated on-chain addresses. We will try our best to track the hacker and try to communicate with the hacker and help everyone recover their losses.
[Transit Swap. Tweet. (Accessed October 2, 2022)].
Their “[…] effort appears successful because the latest update from Transit Finance confirmed that the hacker had returned 70% of the funds to two addresses. But efforts remain underway to recover the remainder of the funds. According to SlowMist, an arbitrage bot front-run the hacker as they transferred BUSD assets from the user on the BSC chain and made 1.07 million BUSD in profit” [Adejumo, supra].
.png)
.png)
However, it appears that not everyone is happy with the 70% recovery. Twitter user @degenwisdom69 tweeted: “Regardless, you should cover the 30% if he doesn’t return any more. This should never of happened” [@degenwisdom69. Tweet. (Accessed October 2, 2022)].
“Reciprocating the updated security measures implemented by crypto businesses, hackers continue to evolve their methods to dupe investors. Recently, a hacker used an Ethereum (ETH) arbitrage trading bot to exploit a “bad code” vulnerability for draining 1,101 ETH, which was around $1.41 million at the time of writing” [Sarkar, supra].
.png)
