{"id":"swapnet-matcha-meta-crypto-theft-jan-2026","category":"breach","status":"closed","title":"SwapNet exploit steals US$13.43 million from 18 Matcha Meta users","tldr":"A SwapNet contract flaw drained US$13.43 million from 18 Matcha Meta users who bypassed One-Time Approval. Revoke direct SwapNet approvals on every chain, including unused exact approvals. Users who kept the default protection were unaffected.","summary":"On 25 January, an attacker exploited SwapNet's trading contracts to move tokens that wallet owners had authorised them to spend. Matcha's revised investigation counted 18 affected users and US$13.43 million stolen, almost all from one user. Those users had disabled Matcha Meta's default One-Time Approval protection and approved SwapNet directly. Matcha says its own and 0x's contracts were unaffected. SwapNet paused its contracts, while Matcha removed the integration and made One-Time Approval mandatory. Revoke.cash warns that pausing did not fix the contracts and outstanding approvals remain a risk. As at 3 November, the reviewed sources do not confirm a contract fix, recovered funds, compensation or arrests.","action":"If you approved SwapNet directly, use Revoke.cash to revoke approvals on every chain to 0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e and 0x6160006C4AA63Ad1cb8CC075d99127F9D8948BB5, including unused approvals for an exact amount. If you only used Matcha Meta's default One-Time Approval setting, Matcha says no action is required.","product":"SwapNet trading contracts used through Matcha Meta","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["swapnet","matcha-meta","crypto","theft","smart-contract","base"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"SwapNet Incident Post Mortem","url":"https://meta.matcha.xyz/SwapNet-Incident-Post-Mortem","by":"Matcha Meta","date":"2026-01-29"},{"kind":"research","title":"SwapNet Hack","url":"https://revoke.cash/exploits/swapnet","by":"Revoke.cash","date":"2026-01-25"},{"kind":"news","title":"Matcha Meta users hit in $13.4 million SwapNet contract exploit","url":"https://www.theblock.co/news/defi/2026-01-26-matcha-meta-swapnet-incident-386986","by":"The Block","date":"2026-01-27"},{"kind":"research","title":"Matcha Meta / SwapNet router exploit hack — January 2026","url":"https://itokenly.com/hacks/matcha-meta-swapnet","by":"iTokenly","date":"2026-08-01"}],"started":"2026-01-25","closed":"2026-08-01","created":"2026-11-03T21:40:24.886Z","updated":"2026-11-03T21:40:24.886Z","cve_notes":[],"timeline":[{"at":"2026-08-01","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"iTokenly's registry review still recorded the incident as unresolved, with no reported recovery or reimbursement and no identified attacker.","url":"https://itokenly.com/hacks/matcha-meta-swapnet","by":"iTokenly","patch":null},{"at":"2026-01-29","added":"2026-11-03T21:35:43.306Z","kind":"vendor-revised","text":"Matcha revised the affected count to 18, superseding the 20 in The Block's earlier report. One user lost approximately US$13.34 million; the US$16.8 million early estimate included an unrelated Aperture Finance theft.","url":"https://meta.matcha.xyz/SwapNet-Incident-Post-Mortem","by":"Matcha Meta","patch":null},{"at":"2026-01-26","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"The Block reported Matcha's post-mortem: SwapNet had been removed and users could no longer disable One-Time Approval. Matcha was working with security firms to trace the money.","url":"https://www.theblock.co/news/defi/2026-01-26-matcha-meta-swapnet-incident-386986","by":"The Block","patch":null},{"at":"2026-01-25","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"SwapNet paused its Base contracts about 45 minutes after the first theft, then paused other chains. Matcha says another 17 users were affected across three chains before the pauses.","url":"https://meta.matcha.xyz/SwapNet-Incident-Post-Mortem","by":"Matcha Meta","patch":null},{"at":"2026-01-25","added":"2026-11-03T21:35:43.306Z","kind":"disclosed","text":"An attacker exploited SwapNet contracts to steal tokens from wallets with direct spending approvals. Matcha's final tally was US$13.43 million stolen from 18 users.","url":"https://meta.matcha.xyz/SwapNet-Incident-Post-Mortem","by":"Matcha Meta","patch":"na"}],"url":"https://hard.fyi/live/swapnet-matcha-meta-crypto-theft-jan-2026/","json":"https://hard.fyi/api/live?id=swapnet-matcha-meta-crypto-theft-jan-2026"}