Decentralized exchange aggregator Matcha Meta reported a security incident involving its SwapNet integration on Sunday, with multiple blockchain security firms flagging a multi-million dollar drain of user funds.
PeckShield estimated that roughly $16.8 million in assets were stolen, citing on-chain data showing the attacker swapped about $10.5 million in USDC on Base for roughly 3,655 ETH before beginning to bridge the funds to Ethereum.
Another security firm, CertiK, earlier reported a smaller estimated loss of around $13.3 million in USDC on Base, identifying the likely exploit as an “arbitrary call” vulnerability in the SwapNet contract that allowed the attacker to transfer funds approved to it.
Matcha Meta did not disclose whether user funds were lost. In an initial update, the project said the exposure was limited to users who had disabled One-Time Approvals and instead set direct allowances on individual aggregator contracts. Users who interacted through One-Time Approval were not affected, it said.
After reviewing the incident with 0x’s protocol team, Matcha Meta later confirmed on X that the issue was not related to 0x’s AllowanceHolder or Settler contracts.
“Users who have disabled One-Time Approval and have set direct allowances on individual aggregator contracts assume the risks of each aggregator,” Meta Match wrote in the X post. “We have removed the ability for users to set allowances on aggregators directly such that this cannot happen moving forward.”
Matcha Meta has yet to issue another update as of writing. The Block has reached out to the team for further comment.
The incident comes as hacking activity continues to weigh on the crypto industry. Cryptocurrency theft totaled more than $3.41 billion in 2025, up from $3.38 billion the prior year, according to Chainalysis. A single $1.5 billion hack of Bybit accounted for 44% of the annual total losses, while North Korea-linked actors were the most prolific threat group, stealing a record $2.02 billion over the year.
© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.