Matcha Meta Breach Drains $16.8M via SwapNet Exploit — Users Urged to Revoke Access
A security breach tied to decentralized exchange aggregator Matcha Meta has resulted in the theft of roughly $16.8 million in crypto assets, adding to a growing list of smart-contract exploits that continue to test the safety assumptions of DeFi users.
The incident unfolded on Sunday and was traced not to Matcha’s core infrastructure, but to SwapNet, one of the liquidity providers integrated into the platform.
Matcha Meta disclosed the issue publicly in a post on X, saying users who had disabled its “One-Time Approval” feature and instead granted direct token allowances to individual aggregator contracts may have been exposed.
We are aware of an incident with SwapNet that users may have been exposed to on Matcha Meta for those who turned off One-Time Approvals
— Matcha Meta
We are in contact with the SwapNet team and they have temporarily disabled their contracts
The team is actively investigating and will provide…(@matchametaxyz) January 25, 2026
The protocol urged affected users to immediately revoke approvals connected to SwapNet’s router contract, warning that failure to do so could leave wallets vulnerable to further unauthorized transfers.
$17M Vanishes in Seconds: How Matcha Hackers Slipped Funds Onto Ethereum
Blockchain security firms quickly began tracking the exploit as funds moved on-chain.
PeckShield reported that approximately $16.8 million had been drained in total, with the attacker swapping around $10.5 million in USDC for roughly 3,655 ETH on the Base network before starting to bridge assets to Ethereum.
#PeckShieldAlert Matcha Meta has reported a security breach involving SwapNet. Users who opted out of "One-Time Approvals" are at risk.
— PeckShieldAlert (@PeckShieldAlert) January 26, 2026
So far, ~$16.8M worth of crypto has been drained.
On #Base, the attacker swapped ~10.5M $USDC for ~3,655 $ETH and has begun bridging funds to… https://t.co/QOyV4IU3P3 pic.twitter.com/6OOJd9cvyF
CertiK independently flagged suspicious transactions, identifying one wallet that siphoned about $13.3 million in USDC on Base and converted the funds into wrapped Ether.
Both firms pointed to a vulnerability in the SwapNet contract that allowed arbitrary calls, enabling the attacker to transfer tokens that users had previously approved.
1/ The vulnerability seems to be in arbitrary call in @0xswapnet contract that let attacker to transfer funds approved to it. (https://t.co/B7ux5zzMLS)
— CertiK Alert (@CertiKAlert) January 26, 2026
The team have temporarily disabled their contracts is actively investigating.https://t.co/NBNvzxHCRw
Please revoke approval…
Matcha later clarified that the incident was not connected to 0x’s AllowanceHolder or Settler contracts, which underpin its One-Time Approval system.
The team noted that users who interacted with Matcha using One-Time Approvals were not affected, as this design limits how much access a third-party contract can retain.
After reviewing with 0x's protocol team, we have confirmed that the nature of the incident was not associated with 0x's AllowanceHolder or Settler contracts.
— Matcha Meta
Users who have interacted with Matcha Meta via One-Time Approval are thus safe.
Users who have disabled One-Time… https://t.co/VQVmj4LL0F(@matchametaxyz) January 25, 2026
The exposure, the team said, applied only to users who opted out of that system and granted ongoing allowances directly to aggregator contracts. In response, Matcha has removed the option for users to set such direct approvals going forward.
Old Token Approvals Emerge as a Persistent DeFi Weak Spot
The breach highlights a recurring tension in DeFi between flexibility and safety. Token approvals, while necessary for interacting with smart contracts, have long been a weak point, particularly when permissions remain active long after a transaction is completed.
In this case, previously granted allowances became the pathway for the exploit once the SwapNet contract was compromised.
The incident arrives amid continued concerns over smart-contract security across the crypto sector.
SlowMist’s year-end report shows that vulnerabilities in smart contracts accounted for just over 30% of crypto exploits in 2025, making them the leading cause of losses.

Researchers have also warned that advances in artificial intelligence are accelerating how quickly attackers can identify and exploit weaknesses in on-chain code.
While overall crypto losses declined in December, falling about 60% month-on-month to roughly $76 million, security firms cautioned that the drop did not reflect a structural improvement.
— Cryptonews.com (@cryptonews) January 2, 2026
Crypto-related losses from hacks and cybersecurity exploits fell sharply in December, dropping 60% month-on-month to about $76 million.#Crypto #Hackhttps://t.co/mke6K8sLVQ
PeckShield noted that a single address-poisoning scam accounted for $50 million of December’s losses, showing how concentrated and severe individual incidents can be even during quieter periods.
January has already seen several notable exploits. IPOR Labs confirmed a $336,000 attack on its USDC Fusion Optimizer vault on Arbitrum, while Truebit disclosed a smart-contract incident that on-chain analysts estimate drained more than 8,500 ETH, triggering a near-total collapse in the project’s token price.
Last week, Layer-1 network Saga paused its SagaEVM chain after an exploit moved close to $7 million in assets to Ethereum.
The post Matcha Meta Breach Drains $16.8M via SwapNet Exploit — Users Urged to Revoke Access appeared first on Cryptonews.

(@matchametaxyz)
Crypto-related losses from hacks and cybersecurity exploits fell sharply in December, dropping 60% month-on-month to about $76 million.
Vitalik Buterin: Verkle Trees Implementation to Benefit Ethereum Stakers and Network Nodes
Ethereum community member Eugenio Reggianini has proposed a technical framework to align Ethereum with EU GDPR rules.

Masked gunmen steal crypto USB in France as prosecutors reveal tax official sold government database access identifying crypto investors to criminal gangs for 800 euros per operation.



@RevolutApp may buy a US bank with a national charter to fast-track its American expansion and bypass the lengthy process of obtaining its own licence.
The OCC has conditionally approved five crypto firms, including
Revolut launches zero-fee stablecoin swaps for its 65 million users as crypto trading drives 298% revenue growth in its wealth division.
Telegram CEO Pavel
Governments are expected to start treating AI data centers and energy-backed computing power as strategic infrastructure in 2026, similar to how oil reserves are managed.


The FBI recorded $9.3 billion losses spread across various crypto-related investment scams, extortion, ATM and kiosks, among others, in 2024.

South Korea's Supreme Court rules Bitcoin on exchanges can be legally seized under Criminal Procedure Act, establishing precedent as regulators expand asset freeze powers and AML enforcement.
ANNOUNCING






UK appoints digital lead to coordinate financial market tokenization, signaling institutional interest in blockchain-based infrastructure.
BNB (@cz_binance)
The SEC has given a key green light to the Depository Trust and Clearing Corporation’s (DTCC) push into blockchain-based markets. 




SEC seeks 10-year officer ban for Caroline Ellison and eight-year prohibitions for Gary Wang and Nishad Singh following FTX fraud cooperation and permanent injunctions.
OneCoin’s legal chief pleaded guilty to money laundering and wire fraud charges, according to a statement released today from the U.S. Attorney’s Office for the Southern District of New York.

Coinbase says crypto market structure bill more complex than stablecoin framework but global competition will force congressional action this year.


(@suji_yan) 

Tom Lee 

The Senate finally confirms
Michael Selig becomes CFTC chairman as Caroline Pham exits agency after implementing major crypto regulatory reforms including spot trading approval and prediction market relief.




