Decentralized exchange aggregator Matcha Meta has found itself embroiled in controversy following a security breach during the SwapNet integration. This incident came to light when on-chain activities were noticed on a Sunday, leading various security firms to provide differing estimates on the extent of the financial losses. Initial findings suggested that the attacker moved USDC assets from the Base network to Ethereum. The project team did not offer a clear picture regarding the user funds’ status.
How Was the SwapNet Breach Detected?
The first report, based on on-chain analyses, was shared by PeckShield, revealing that approximately $16.8 million worth of assets had been illicitly drained. The data indicated that the attacker swapped $10.5 million in USDC on the Base network to acquire about 3,655 ETH and subsequently bridged it to the Ethereum network. The rapid pace of these transactions hinted at an automated exploitation scenario.
Another security firm, CertiK, released an earlier assessment estimating the loss at around $13.3 million. According to CertiK, the vulnerability stemmed from an “arbitrary call” issue within the SwapNet contract, allowing the attacker to transfer authorized funds. The discrepancy in figures between the two reports arose from additional transactions detected during the bridging process and methodological differences.
In its initial response, Matcha Meta claimed that accounts using the One-Time Approval feature were unaffected, only those directly authorizing contracts faced risks. The project limited the attack’s scope based on this framework.
User Authorizations and Industry Impact
Following the incident, Matcha Meta announced its investigation in collaboration with the 0x team, clarifying that the problem was not linked to 0x’s AllowanceHolder or Settler contracts. The statement emphasized that giving direct authorization to individual aggregator contracts posed additional risks for users. Thus, the direct authorization option was removed to prevent similar occurrences.
Even as Matcha Meta has yet to issue a new status update, the broader industry is increasingly concerned over the rising wave of attacks. Chainalysis data showed that cryptocurrency thefts exceeded $3.41 billion in 2025. A single attack at Bybit, amounting to $1.5 billion, accounted for nearly half of the yearly losses.
Experts contend that the Matcha Meta case highlights the necessity of aligning permission mechanisms designed to enhance user experience with robust security architectures. As cross-chain bridging and aggregator contracts become more prevalent, the attack surface expands, intensifying discussions on how risks are transferred to end users.
