Disabling this feature led to a $16.8M exploit on Matcha Meta

In yet another incident of protocol hacks, bad actors have exploited the funds of SwapNet users on decentralized exchange (DEX) aggregator Matcha Meta. Consequently, $16.8 million in crypto assets were drained, making the incident a significant one among the list of hacks that occurred as 2026 began. 

For newbies, a DEX aggregator is a tool that searches for the best tokens to swap across all leading DEXs.   

Matcha Meta informed about the incident on X, stating that SwapNet users who turned off One-Time Approvals were exposed to the exploit. SwapNet is another multichain DEX aggregator that acts as a backend engine, which Matcha Meta uses to integrate and execute swaps across liquidity pools.   

How were users who turned off One-Time Approvals affected?

As mentioned, hackers exploited the funds of users who turned off one-time approval. In a one-time approval contract, users can spend tokens for a single transaction. Once the transaction is over, the contract can no longer access the token.

Meanwhile, in unlimited approvals, the contract allows users to spend tokens regardless of the number of tokens and number of times. 

As hackers intruded, they targeted the users who turned off the One-Time Approval. This allowed them to drain funds easily, as the contract cannot further access tokens once a transaction is over.   

SwapNet users on the Base chain confirm exploitation 

According to on-chain investigator PeckShieldAlert, hackers breached SwapNet activities that existed on Base, an Ethereum Layer-2 blockchain platform owned by Coinbase. To avoid confusion, SwapNet users were affected, and Base was one of the chains that was exposed.

At the time of reporting, there was no information regarding any additional chains being exposed. The hacker swapped nearly 10.5 million USDC stablecoins for 3,655 ETH on the Base blockchain and bridged the funds to Ethereum.

Following the hack, the SwapNet team has temporarily paused its contracts upon request from the Matcha Meta team. The DEX aggregator has also recommended to repeal all the approvals to individual aggregators outside 0x’s One-Time Approval contracts.

0x is a protocol that provides infrastructure for DEXs. The investigation is currently proceeding, and further updates will be provided in due time.