Transit Finance exploited for $1.8M via legacy contract

Transit Finance lost about $1.8 million in a cross-chain exploit linked to an outdated smart contract. The stolen funds moved from Tron to Ethereum, with no recovery plan announced.

Transit Finance, a cross-chain DeFi protocol, suffered an exploit on May 13, resulting in losses estimated between $1.8 million and $1.88 million, primarily in DAI stablecoins. Blockchain security firms PeckShield and Defimon Alerts identified suspicious transfers from a Tron-linked address to an Ethereum wallet now holding the stolen funds. The attack targeted Transit Finance’s cross-chain swap infrastructure, which enables asset trades across multiple blockchain networks. Investigations revealed the exploit stemmed from a historical vulnerability in a deprecated smart contract version originally deployed on the Tron network. Current contracts are reportedly unaffected. Transit Finance has not yet released a detailed technical post-mortem or a recovery plan but has sent an onchain message to the attacker. This incident raises further concerns about DeFi security, especially for cross-chain protocols, amid a year of significant losses from similar exploits.