Millions Slip Away as Security Breach Strikes Matcha Meta

How Was the SwapNet Breach Detected?

The first report, based on on-chain analyses, was shared by PeckShield, revealing that approximately $16.8 million worth of assets had been illicitly drained. The data indicated that the attacker swapped $10.5 million in USDC on the Base network to acquire about 3,655 ETH and subsequently bridged it to the Ethereum network. The rapid pace of these transactions hinted at an automated exploitation scenario.

Another security firm, CertiK, released an earlier assessment estimating the loss at around $13.3 million. According to CertiK, the vulnerability stemmed from an “arbitrary call” issue within the SwapNet contract, allowing the attacker to transfer authorized funds. The discrepancy in figures between the two reports arose from additional transactions detected during the bridging process and methodological differences.

In its initial response, Matcha Meta claimed that accounts using the One-Time Approval feature were unaffected, only those directly authorizing contracts faced risks. The project limited the attack’s scope based on this framework.

User Authorizations and Industry Impact

Following the incident, Matcha Meta announced its investigation in collaboration with the 0x team, clarifying that the problem was not linked to 0x’s AllowanceHolder or Settler contracts. The statement emphasized that giving direct authorization to individual aggregator contracts posed additional risks for users. Thus, the direct authorization option was removed to prevent similar occurrences.

Even as Matcha Meta has yet to issue a new status update, the broader industry is increasingly concerned over the rising wave of attacks. Chainalysis data showed that cryptocurrency thefts exceeded $3.41 billion in 2025. A single attack at Bybit, amounting to $1.5 billion, accounted for nearly half of the yearly losses.

Experts contend that the Matcha Meta case highlights the necessity of aligning permission mechanisms designed to enhance user experience with robust security architectures. As cross-chain bridging and aggregator contracts become more prevalent, the attack surface expands, intensifying discussions on how risks are transferred to end users.