Transit Swap Loses $21M to a transferFrom Approval Exploit, Then Gets Most of It Back

Another weekend, another cross-chain protocol hemorrhaging funds. On Sunday, October 2, 2022, Transit Swap confirmed that an unidentified attacker had siphoned roughly $21 million by abusing a flaw that let the exploiter pull tokens directly out of user wallets that had granted approvals to the protocol's swap contracts.

The attacker didn't walk away clean, however. Over $1 million of the haul ended up stuck in transit — proof that not every automated bot profits from these situations.

Transit Swap's team froze the compromised contracts and put out an incident notice on Twitter. A follow-up update credited a combined effort by SlowMist, Bitrace, and PeckShield with uncovering identifying details about the attacker — reportedly including an IP address, an email, and linked on-chain addresses.

Once that anonymity started to erode, the attacker apparently reconsidered. By the time of reporting, more than 70% of the stolen funds had already been sent back.

Open questions remain about how the flaw was found in the first place — was it careful reverse-engineering of an unverified contract, or something closer to an inside tip?

01How the Exploit Worked

The root cause sat in the project's code, but the attack itself hit users' wallets directly by abusing how the contract called the transferFrom() function. Any token a user had approved for trading on Transit Swap could be pulled straight out of their wallet into the attacker's address, without further consent.

The first attack transaction landed just after 18:30 UTC. The exploit window ran roughly 30 minutes before the attacker began converting the stolen assets into ETH and BNB.

Attacker's address (same on both chains): 0x75f2aba6a44580d7be2c4e42885d4a1917bffd46 — also viewable on BscScan.

The vulnerable contract (users needed to revoke approvals on both Ethereum and BSC): 0xed1afc8c4604958c2f38a3408fa63b32e737c428

Credit for the analysis goes to Supremacy Inc. and SlowMist.

Since Transit Swap's contracts were never published as verified source, investigators had to decompile the bytecode to find the bug. As SlowMist explained in its writeup, once the attacker's path was mapped out, the team faced closed-source contracts and had to reverse-engineer the bytecode — eventually tracing the issue to a claimTokens function that made a controllable external call to transferFrom.

Because the recovered code was decompiled rather than original source, it reads awkwardly: the variable varg0 represents the token address, while varg1, varg2, and varg3 correspond to the from, to, and amount arguments of transferFrom. The function selector 0x23b872dd seen in the analysis is simply the signature for transferFrom(). In short, claimTokens invoked transferFrom on an arbitrary address using parameters the caller could fully control — meaning anyone could specify whose tokens moved, where they went, and how much.

Readers wanting the full technical breakdown should consult SlowMist's published analysis. PeckShield also released a visual summary thread tracing the attacker's movements.

02The Money Trail

Returned assets were funneled into a single consolidation address — 0xD989f7B4320c6e69ceA3d914444c19AB67D3a35E on Ethereum, mirrored on BSC — which held roughly $16.5 million combined across both chains.

Breakdown of stolen and recovered funds:

• 3,180 ETH (~$4.2M) — returned
• 1,500 Binance-pegged ETH (~$2M) — returned
• 50,000 BNB (~$14M) — $10.4M of it returned

As of publication, the exploiter's BSC address still held more than $3.5 million in unreturned BNB, and had earlier routed 2,500 BNB (about $715,000) to Tornado Cash.

03Takeaways

Quick coordination between multiple independent security teams gave this one a comparatively soft landing versus most DeFi exploits of this scale.

Still, running unverified contracts in production remains a red flag for a space built on the premise of open-source transparency. When code is hidden, community auditing becomes nearly impossible, and whitehats lose their best chance to catch vulnerabilities before attackers do.

Closed-source deployments also invite speculation in an industry where hacks, rug pulls, and "compromised keys" tend to fade from memory within weeks. Whether this was an outsider's clever decompilation or an insider quietly cashing in before returning most of the loot to avoid scrutiny remains an open question.