2026 Matcha Meta — SwapNet exploit, $16.8M loss
Data compromised
$16.8M digital assets
Technical writeup
Swap/bridge aggregation platform. SwapNet (external aggregator) exploited Jan 25, 2026. Token approval abuse drained ~10.5M USDC from victim addresses on Base; swapped for 3,655 ETH. Users with direct token permissions to aggregators (not One-Time Approvals) at risk. $16.8M total loss.
Root cause
Smart contract exploit; token approval abuse