Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnAISquareMore
Millions Slip Away as Security Breach Strikes Matcha Meta

Millions Slip Away as Security Breach Strikes Matcha Meta

CointurkCointurk2026/01/26 08:09
By:Cointurk

Decentralized exchange aggregator Matcha Meta has found itself embroiled in controversy following a security breach during the SwapNet integration. This incident came to light when on-chain activities were noticed on a Sunday, leading various security firms to provide differing estimates on the extent of the financial losses. Initial findings suggested that the attacker moved USDC assets from the Base network to Ethereum. The project team did not offer a clear picture regarding the user funds’ status.

How Was the SwapNet Breach Detected?

The first report, based on on-chain analyses, was shared by PeckShield, revealing that approximately $16.8 million worth of assets had been illicitly drained. The data indicated that the attacker swapped $10.5 million in USDC on the Base network to acquire about 3,655 ETH and subsequently bridged it to the Ethereum network. The rapid pace of these transactions hinted at an automated exploitation scenario.

Another security firm, CertiK, released an earlier assessment estimating the loss at around $13.3 million. According to CertiK, the vulnerability stemmed from an “arbitrary call” issue within the SwapNet contract, allowing the attacker to transfer authorized funds. The discrepancy in figures between the two reports arose from additional transactions detected during the bridging process and methodological differences.

In its initial response, Matcha Meta claimed that accounts using the One-Time Approval feature were unaffected, only those directly authorizing contracts faced risks. The project limited the attack’s scope based on this framework.

User Authorizations and Industry Impact

Following the incident, Matcha Meta announced its investigation in collaboration with the 0x team, clarifying that the problem was not linked to 0x’s AllowanceHolder or Settler contracts. The statement emphasized that giving direct authorization to individual aggregator contracts posed additional risks for users. Thus, the direct authorization option was removed to prevent similar occurrences.

Even as Matcha Meta has yet to issue a new status update, the broader industry is increasingly concerned over the rising wave of attacks. Chainalysis data showed that cryptocurrency thefts exceeded $3.41 billion in 2025. A single attack at Bybit, amounting to $1.5 billion, accounted for nearly half of the yearly losses.

Experts contend that the Matcha Meta case highlights the necessity of aligning permission mechanisms designed to enhance user experience with robust security architectures. As cross-chain bridging and aggregator contracts become more prevalent, the attack surface expands, intensifying discussions on how risks are transferred to end users.

0
1

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

Understand the market, then trade.
Bitget offers one-stop trading for cryptocurrencies, stocks, and gold.
Trade now!

You may also like

Goldman Sachs Head of Hedge Fund Business: Oil prices are more important than the Jackson Hole Fed meeting; Nvidia is the focus this week

Privorotsky, Head of Hedge Funds at Goldman Sachs, issued a warning this week: the movement of oil prices may have a greater impact on the stock market than the Jackson Hole Symposium—lowering energy prices might be the fastest way to stabilize the bond market. Although Nvidia’s earnings are expected to be “absurdly strong,” there are undercurrents of concern regarding an AI financing bubble, rising memory costs, and valuation compression. He suggests going long on financials and industrials, holding “S&P + gold,” waiting for the right opportunity to short bonds, and for semiconductors, waiting until earnings catch up with valuations before seeking a breakout.

华尔街见闻2026/08/25 00:56

The U.S. pressures Korean semiconductors to build factories in the U.S., expresses dissatisfaction with South Korea's “Honam Semiconductor Cluster Plan”

According to reports, officials from South Korea's ruling party revealed that the US side has explicitly requested Korean companies to build memory factories in the US to ensure supply. After the announcement of a mega semiconductor project in Hunan, pressure on semiconductor investments has increased significantly, with accusations that Korean companies have delayed implementing their semiconductor investment plans in the US. The South Korean government plans to announce the first batch of US investment projects at some time in September.

华尔街见闻2026/08/25 00:56