Decentralized Exchange Aggregator Transit Swap Loses $21 Million In Exploit

Popular decentralized exchange aggregator Transit Swap has confirmed losing $21 million in an exploit that was implemented via an internal bug on a swap contract. The platform has issued a public apology as well.

According to several Twitter posts from the multi-chain aggregator, the project team is working tirelessly to recover the stolen funds, and as per blockchain security firm Slowmist, the Transit Swap hacker was front-run by an arbitrage bot when he transferred BUSD assets from the user on the BSC chain (block height 21816885) and made a profit of $1.07 million.

Arbitrage bots trade the small slippages in prices and multi-chain decentralized exchange aggregators capture different prices from all the DEXs and list them for the users who can then complete their order while choosing the exchange with the lowest fees and most accurate price.

"With the joint efforts of all parties, the hacker has returned about 70% of the stolen assets to the Transit Swap," Slowmist confirmed. On the other hand, Transit Swap issued a public apology, confirming that it was a bug in their code which led to the attack.

In a series of Twitter posts, Transit Swap stated that the security teams of PeckShield, Slowmist, Bitrace, Transit Finance, and TokenPocket are attempting to trace the hacker's location and the funds as well.

"We now have a lot of valid information such as the hacker's IP, email address, and associated on-chain addresses. We will try our best to track the hacker and try to communicate with the hacker and help everyone recover their losses," Transit Swap said.

Additionally, the platform plans to return all the recovered funds to the users and stated that it "is rushing to collect the specific data of the stolen users and formulate a specific return plan."

"The team will continue to recover the remaining assets of hackers' stolen assets and return them to the lost users," the decentralized exchange aggregator added.