On May 12, 2026, Transit Finance on Tron was exploited for $1.88M via deprecated contract officially discontinued in 2022 but left active on-chain. Attacker exploited historical vulnerabilities to drain DAI and other assets.

Decentralized cross-chain aggregation protocol Transit Finance suffered an exploit on its deprecated (2022-era) TRON smart contract, resulting in approximately $1.88 million in DAI being drained. The stolen funds were transferred to an Ethereum address. The team confirmed it was isolated to legacy code, stated that current contracts are secure, completed remediation on May 12, and promised full user compensation. They sent an on-chain message to the attacker offering a bug bounty for return within 48 hours, or they would pursue legal action.