Matcha Meta Removes Direct Allowances After $16.8M SwapNet Exploit as Crypto Hacks Rise

Decentralized exchange aggregator Matcha Meta temporarily disabled SwapNet contracts and removed direct allowances following a $16.8 million exploit. The incident, identified as an arbitrary call vulnerability in SwapNet's smart contract, allowed an attacker to drain approved user funds. Matcha Meta reported the breach on January 25, citing exposure for users who disabled One-Time Approval and granted direct allowances to individual aggregator contracts.

Security firms including PeckShield and CertiK have confirmed the scale of the breach. PeckShield estimated $16.8 million was stolen, while CertiK reported a smaller loss of $13.3 million in USDC on Base. According to on-chain data, the attacker swapped $10.5 million in USDC for 3,655 ETH before bridging assets to Ethereum.

Matcha Meta urged users to revoke approvals tied to SwapNet's router contract to prevent further unauthorized transfers. The team also confirmed that the issue was not related to its own infrastructure but rather a flaw in SwapNet's smart contract.

Why Did This Happen?

The exploit stemmed from an arbitrary call vulnerability in the SwapNet contract, allowing the attacker to transfer funds that users had approved for it. Matcha Meta highlighted that users who disabled the platform's One-Time Approval feature and instead used direct allowances are at risk, as each aggregator contract carries its own set of vulnerabilities.

The breach has reinvigorated discussions about the risks associated with direct allowances in DeFi platforms. These mechanisms are often used to streamline transactions but can expose users if not managed carefully.

How Did Markets Respond?

The breach adds to a growing list of smart-contract exploits in the DeFi space. In 2025, smart-contract vulnerabilities accounted for 30.5% of all crypto exploits, with 56 cybersecurity incidents reported. The loss highlights the need for stronger safeguards and clearer user guidance, especially as more institutional and retail users adopt DeFi platforms.

Market participants are also monitoring broader trends in crypto security. Total cryptocurrency theft reached $3.41 billion in 2025, with a single $1.5 billion hack of Bybit contributing to 44% of the total. This underscores the scale and frequency of such breaches and the importance of proactive security measures.

What Are Analysts Watching Next?

Analysts are closely following Matcha Meta's response to the breach and whether users will be compensated. The platform has yet to provide a statement on potential restitution or plans to strengthen safeguards.

Regulators and industry participants are also keeping an eye on the broader implications for DeFi security. Recent initiatives, such as Tether's collaboration with the United Nations Office on Drugs and Crime, highlight efforts to counter organized crime and illicit financial flows.

The incident also raises questions about the role of liquidity providers in DeFi ecosystems. As platforms integrate third-party protocols, they must balance innovation with security. The breach underscores the risks associated with integrating external smart contracts and the importance of rigorous audits and monitoring.