Crypto hacker returns 70% of $23 million to Transit Swap

How crypto hack succeeded

Funds went missing from Transit Swap after a hacker exploited an internal bug on a swap contract on October 1 2022. The cross-chain DEX (decentralized exchange) aggregator prompted a quick response from the Transit Finance team and security firms Peckshield, SlowMist, Bitrace, and TokenPocket. They were able to work out the hacker's IP, email address, and associated-on chain addresses quickly.

"We sincerely apologise", said Transit Swap on Twitter. The company said that security firms are tracking the necessary data on-chain, and they will alert customers of any additional notifications as they arise.

Less than 24 hours after the theft, Transit Finance reported that "with the combined efforts of all parties," the hacker had returned 70% of the stolen assets to two addresses, totaling around $16.2 million.

The hacker appears to have had to hand over the crypto after the Transit Finance team and various security firms obtained data about the perpetrator.

According to BscScan and EtherScan, this crypto came in the form of 3,180 Ether (ETH) valued at $4.2 million, 1,500 Binance-Peg ETH valued at $2 million, and 50,000 BNB valued at $14.2 million.

Plan for the return of the rest of the monies from the crypto hack

According to the most recent update, "the project team is scrambling to collect the exact information of users whose crypto got stolen and design a specific return strategy". Still, it focuses on recovering the remaining 30% of stolen monies.

At the moment, security companies and project teams from all sides are still tracking the hacking issue and communicating with the hacker via email and on-chain techniques. It said the group would continue working tirelessly to retrieve more assets.

#Plan for the return of the rest of the monies from the crypto hack hted](https://slowmist.medium.com/cross-chain-dex-aggregator-transit-swap-hacked-analysis-74ba39c22020) that the hacker exploited a vulnerability in Transit Swap's smart contract code, which came directly from the transferFrom() function, which essentially allowed users' tokens to be sent directly to the exploiter's address.