Matcha Meta SwapNet Security Breach Drains $16.8 Million

The post Matcha Meta SwapNet Security Breach Drains $16.8 Million appeared first on Coinpedia Fintech News

Blockchain security platform PeckShieldAlert has flagged a major security breach involving SwapNet, affecting users who interact through Matcha Meta. Meanwhile, attackers exploited token approvals to drain $16.8 millions in crypto. 

PeckShieldAlert data reveal how disabled safety settings exposed users to unexpected losses.

How the SwapNet Hack Happened

According to PeckShieldAlert, the hack did not happen due to a flaw in Matcha Meta itself, but because of how some users managed token approvals.

Matcha Meta offers a One-Time Approval feature, which limits token access to a single transaction. However, users who turned off this feature and instead gave direct, long-term allowances to individual aggregator contracts exposed themselves to higher risk.

#PeckShieldAlert Matcha Meta has reported a security breach involving SwapNet. Users who opted out of "One-Time Approvals" are at risk.

So far, ~$16.8M worth of crypto has been drained.

On #Base, the attacker swapped ~10.5M $USDC for ~3,655 $ETH and has begun bridging funds to… https://t.co/QOyV4IU3P3 pic.twitter.com/6OOJd9cvyF

— PeckShieldAlert (@PeckShieldAlert) January 26, 2026

Attackers took advantage of these permanent approvals linked to SwapNet. Once access was granted, the hacker could move funds freely without needing further user confirmation. This is how wallets were drained without users actively signing new transactions.

On-Chain Activity Confirms Fund Movement

Blockchain data shows that the attacker focused heavily on the Base network. Around $10.5 million worth of USDC was swapped for roughly 3,655 ETH. Shortly after, the attacker began bridging the funds from Base to Ethereum, a common tactic used to reduce traceability.

Additional transaction records reveal large USDC transfers exceeding $13 million, along with Uniswap V3 liquidity interactions. Altogether, PeckShieldAlert estimates that approximately $16.8 million in crypto was stolen.

Matcha Meta and SwapNet’s Response

Matcha Meta quickly acknowledged the incident and confirmed it is working closely with the SwapNet team. As an immediate step, SwapNet temporarily disabled its contracts to prevent further exploitation.

To protect users going forward, Matcha Meta removed the option to set direct aggregator allowances, ensuring this type of exposure cannot happen again. The platform also urged users to revoke all existing approvals outside of 0x’s One-Time Approval contracts, especially those linked to SwapNet’s router contract.

We are aware of an incident with SwapNet that users may have been exposed to on Matcha Meta for those who turned off One-Time Approvals

We are in contact with the SwapNet team and they have temporarily disabled their contracts

The team is actively investigating and will provide…

— Matcha Meta (@matchametaxyz) January 25, 2026

Investigations are ongoing, and both teams have promised continuous updates as they work to understand the full impact and monitor the stolen funds.