Transit Finance Deprecated TRON Contract Exploit — $1.88M DAI Drain

Timeline: On May 12, 2026 (on-chain timestamp), an attacker drained ~$1.88M in DAI from a Transit Finance smart contract that had been deprecated since 2022 but remained accessible. PeckShield publicly flagged the exploit on May 13 at 12:21 UTC, naming the attacker EOA 0x8a634DfA2609358849D7D65FFA270C8A57a8abA5 holding ~1.875M DAI. The contract was originally part of the TRON-side Transit Swap infrastructure, identified as having a similar vulnerability class to the October 2022 Transit Swap hack (~$28.9M). Transit Finance sent an on-chain message offering a bug bounty dialogue within a 48-hour window. Within 12 hours, the team publicly committed to fully compensate affected users. Security reviews completed May 12 confirmed that the current production contract version is unaffected. As of May 16, the funds remain parked at the attacker EOA pending bounty negotiation outcome.