Matcha Meta suffers $16.8M loss in SwapNet breach

Matcha Meta lost $16.8M in a SwapNet breach, mainly affecting users who disabled "One-Time Approval." Investigations and security measures are underway.

Matcha Meta, a decentralized exchange aggregator, experienced a major security breach linked to its integration with SwapNet, resulting in the loss of approximately $16.8 million in digital assets. The breach was detected after suspicious on-chain activity revealed unauthorized USDC transfers from the Base network to Ethereum. The attacker converted $10.5 million USDC into about 3,655 ETH and bridged it to Ethereum. Security firms PeckShield and CertiK reported varying loss estimates, with CertiK attributing the incident to an "arbitrary call" vulnerability in the SwapNet contract. The breach primarily affected users who had disabled Matcha Meta’s "One-Time Approval" feature and instead granted direct token permissions to aggregators. In response, SwapNet temporarily suspended its contracts, and Matcha Meta removed the feature allowing users to set limits directly with the aggregator. The investigation is ongoing, and the status of affected user funds remains uncertain.