Matcha Meta Suffers $16.8M Exploit via SwapNet Security Breach On January 25, 2026, Matcha Meta, a swap and bridge aggregation platform built by 0x, confirmed a $16.8 million loss in digital assets due to a security breach in SwapNet, an external aggregator integrated into its interface. The attack occurred over the weekend, targeting users who had disabled Matcha Meta’s "One-Time Approvals" feature and granted direct token permissions to SwapNet. According to PeckShield, the attacker exploited token approvals to drain funds, swapping 10.5 million USDC from victim addresses on Base (an Ethereum Layer-2) for 3,655 ETH before bridging the assets to the Ethereum mainnet to obscure transaction trails. The breach stemmed from unlimited token allowances, which allowed the attacker to move funds without user signatures once permissions were granted. Matcha Meta clarified that users who relied on its One-Time Approval system which routes permissions through 0x’s AllowanceHolder and Settler contracts were unaffected. The platform has since disabled direct allowance settings for aggregators and urged users to revoke existing permissions on SwapNet’s router contract. The incident follows a $4.13 million exploit of Makina Finance on January 19, where attackers drained a DUSD/USDC liquidity pool on Curve via a compromised pricing oracle. DeFi breaches remain persistent in 2026, with similar attacks reported on platforms like CoWSwap in 2025, where a solver account exploit led to $180,000 in DAI losses. Blockchain analytics firm Elliptic notes that such exploits often leverage coin swap services for money laundering.