Matcha Meta Breach Results in $16.8M Loss — Users Advised to Revoke Access

A recent security breach involving Matcha Meta, a decentralized exchange aggregator, has led to the loss of approximately $16.8 million in cryptocurrency assets. The breach was linked to SwapNet, a third-party liquidity provider. Affected users are strongly encouraged to revoke token approvals associated with SwapNet to protect their wallets from further unauthorized transactions.

Key Takeaways

Matcha Meta experienced a security breach that resulted in the theft of $16.8 million in crypto assets.
The exploit was traced to vulnerabilities within the SwapNet liquidity provider, not Matcha's own infrastructure.
Users who previously granted direct token allowances may have been exposed; they are urged to revoke these approvals.
The incident highlights ongoing security issues in decentralized finance (DeFi) and the risks associated with token approvals.

Incident Overview: $17M Vanishes in Seconds

The incident occurred this past Sunday and raised alarms among blockchain security firms as assets were moved on-chain. PeckShield reported that approximately $16.8 million was siphoned off, with the attacker converting around $10.5 million in USDC to roughly 3,655 ETH on the Base network before transferring the assets to Ethereum.

CertiK also identified suspicious transactions related to this exploit, which pinpointed one wallet that drained approximately $13.3 million in USDC on the Base and converted it into wrapped Ether. Both security firms highlighted a critical vulnerability in the SwapNet contract that allowed the attacker to make arbitrary calls, enabling the transfer of tokens that users had previously approved.

Matcha Meta clarified that this breach was not associated with the 0x's AllowanceHolder or Settler contracts that enforce its One-Time Approval system. Users utilizing One-Time Approvals were not impacted, as this feature limits the access third-party contracts can maintain. The vulnerability only affected users who opted for direct token allowances, leading to Matcha removing this feature to enhance security.

The Ongoing Challenge of Old Token Approvals in DeFi

This incident underscores a persistent challenge in the DeFi space: balancing flexibility with security. Token approvals are essential for interacting with smart contracts, but these permissions can remain active long after a transaction concludes. Once the SwapNet contract was compromised, previously granted allowances became a vulnerability.

Concerns surrounding smart contract security continue to loom large in the crypto sector. A year-end report from SlowMist indicates that vulnerabilities in smart contracts accounted for over 30% of cryptocurrency exploits in 2025, marking them as the primary cause of financial losses.

Image highlighting security concerns

Moreover, experts warn that advancements in artificial intelligence are enabling attackers to more swiftly identify and exploit weaknesses in on-chain code. While overall crypto losses saw a decrease in December—down about 60% to roughly $76 million—security firms stressed that this decline does not signal a systemic improvement. For instance, a single address-poisoning scam contributed to $50 million of the month's losses, illustrating that severe incidents can still occur, even during quieter periods.

As we begin January, multiple significant exploits have already come to light. IPOR Labs confirmed a $336,000 attack on its USDC Fusion Optimizer vault on Arbitrum, while Truebit disclosed a smart contract incident that led to an estimated loss of over 8,500 ETH, drastically affecting the project's token price. Additionally, last week, Layer-1 network Saga paused its SagaEVM chain to respond to an exploit that transferred close to $7 million in assets to Ethereum.