Transit Finance $1.8M Exploit Exposes Cross-Chain Risk

Transit Finance, a cross-chain swap aggregator routing trades across more than a dozen blockchain networks, was exploited for $1.8 million in DAI stablecoins, according to blockchain security firm PeckShield. The firm flagged the breach on Wednesday and identified a single Ethereum address currently holding the stolen funds. The incident is the latest in a string of attacks targeting the interconnected architecture of cross-chain systems, where a single approval flaw can drain liquidity from multiple pools.

The $1.8M DAI Drain and the Address Holding the Funds

The attacker moved the $1.8 million in DAI to one Ethereum address, a pattern that simplifies tracking however also signals a potential plan to launder the funds through a mixer or cross-chain bridge. Transit Finance aggregates swap routes across networks, meaning users grant token approvals to its smart contracts. An exploit that compromises the swap mechanism can siphon assets from any wallet that has not revoked those approvals. The current breach appears smaller than the protocol’s October 2022 exploit, when $28.9 million was stolen through improper input validation in the same swap logic. A portion of those funds was later recovered.

The simple read is that a $1.8 million loss is manageable for a protocol that has survived a much larger attack. The better read is that the recurrence of an approval-based exploit on the same aggregator suggests the underlying contract architecture still contains vectors that sophisticated attackers can reuse. Users who have not revoked old approvals remain exposed, and the single-address holding pattern gives a narrow window for recovery before funds move.

Transit Finance’s Cross-Chain Exposure and Prior Exploit

Transit Finance operates as a cross-chain swap aggregator, connecting liquidity across more than a dozen blockchains. This design expands its attack surface: a vulnerability in one chain’s integration can cascade to assets on other networks. The 2022 exploit drained $28.9 million by exploiting improper input validation, allowing unauthorized transfers from users who had granted token approvals. The protocol recovered a portion of those funds, however the incident left a residual approval risk for wallets that never revoked permissions.

The current $1.8 million DAI drain suggests the attacker may have targeted a similar approval vector or a new flaw in the swap routing logic. Because Transit Finance does not custody assets directly, the loss is borne by users who had active approvals. The protocol’s total value locked and the number of affected wallets are not yet disclosed, however the single-address concentration of the stolen funds indicates the attacker has not yet distributed the proceeds across multiple wallets or chains.