SwapNet exploit steals US$13.43 million from 18 Matcha Meta users
A SwapNet contract flaw drained US$13.43 million from 18 Matcha Meta users who bypassed One-Time Approval. Revoke direct SwapNet approvals on every chain, including unused exact approvals. Users who kept the default protection were unaffected.
If you approved SwapNet directly, use Revoke.cash to revoke approvals on every chain to 0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e and 0x6160006C4AA63Ad1cb8CC075d99127F9D8948BB5, including unused approvals for an exact amount. If you only used Matcha Meta's default One-Time Approval setting, Matcha says no action is required.
What’s happening
On 25 January, an attacker exploited SwapNet's trading contracts to move tokens that wallet owners had authorised them to spend. Matcha's revised investigation counted 18 affected users and US$13.43 million stolen, almost all from one user. Those users had disabled Matcha Meta's default One-Time Approval protection and approved SwapNet directly. Matcha says its own and 0x's contracts were unaffected. SwapNet paused its contracts, while Matcha removed the integration and made One-Time Approval mandatory. Revoke.cash warns that pausing did not fix the contracts and outstanding approvals remain a risk. As at 3 November, the reviewed sources do not confirm a contract fix, recovered funds, compensation or arrests.
- What
- Breach
- Affects
- SwapNet trading contracts used through Matcha Meta
- Fixed in
- Nothing to patch
- Since
- 25 Jan 2026
- Closed
- 1 Aug 2026
Timeline
- Update
iTokenly's registry review still recorded the incident as unresolved, with no reported recovery or reimbursement and no identified attacker.
- Vendor revised
Matcha revised the affected count to 18, superseding the 20 in The Block's earlier report. One user lost approximately US$13.34 million; the US$16.8 million early estimate included an unrelated Aperture Finance theft.
- Update
The Block reported Matcha's post-mortem: SwapNet had been removed and users could no longer disable One-Time Approval. Matcha was working with security firms to trace the money.
- Update
SwapNet paused its Base contracts about 45 minutes after the first theft, then paused other chains. Matcha says another 17 users were affected across three chains before the pauses.
- Made publicNothing to patch
An attacker exploited SwapNet contracts to steal tokens from wallets with direct spending approvals. Matcha's final tally was US$13.43 million stolen from 18 users.
Sources
- SwapNet Incident Post MortemMatcha Meta · 29 Jan 2026
- SwapNet HackRevoke.cash · 25 Jan 2026
- Matcha Meta users hit in $13.4 million SwapNet contract exploitThe Block · 27 Jan 2026
- Matcha Meta / SwapNet router exploit hack — January 2026iTokenly · 1 Aug 2026