Matcha Meta reports Base SwapNet exploit, $16.8M lost
An exploit of Matcha Meta’s SwapNet on Base drained about $16.8 million. Users with direct approvals were affected; those using One-Time Approval were not, the company and security firms reported.
Decentralized exchange aggregator Matcha Meta reported on Sunday a security incident involving its SwapNet integration. PeckShield estimated losses at about $16.8 million.
On-chain data reviewed by PeckShield indicate the attacker swapped roughly $10.5 million in USDC on Base for about 3,655 ETH, then began bridging funds to Ethereum.
Matcha Meta indicated that exposure was limited to users who had disabled One-Time Approvals and instead set token allowances directly on individual aggregator contracts. Users who relied on One-Time Approval were not affected.
After a review with the 0x protocol team, Matcha Meta clarified the issue did not involve 0x’s AllowanceHolder or Settler contracts. In an X post, the project wrote: “Users who have disabled One-Time Approval and have set direct allowances on individual aggregator contracts assume the risks of each aggregator.” The post added: “We have removed the ability for users to set allowances on aggregators directly such that this cannot happen moving forward.”
Another security firm, CertiK, put the loss at around $13.3 million on Base and pointed to an “arbitrary call” weakness in the SwapNet contract that enabled transfers of tokens previously approved to it.
As we reported earlier, crypto investors and European enterprises have been buying hardware wallets and other secure devices at a record pace in 2025 after on-chain and exchange hacks stole about $2.2 billion in the first half, more than in all of 2024.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
