Matcha Meta breach tied to SwapNet exploit drains up to $16.8M

A major cybersecurity incident has shaken the decentralized finance (DeFi) space, as the trading aggregator platform Matcha Meta confirmed a significant exploit tied to its integrated SwapNet liquidity pool. The breach, which occurred late Friday, resulted in the unauthorized drainage of digital assets totaling approximately $16.8 million from user wallets.

### Exploit Details

Initial investigations conducted by internal security teams and external blockchain forensics experts indicate that the attackers leveraged a critical vulnerability within the SwapNet protocol’s smart contract logic. Specifically, the exploit targeted a flaw in the token approval delegation mechanism, which governs how user funds are moved between SwapNet and Matcha Meta during aggregated trades.

Attackers exploited faulty input validation in the SwapNet contract, enabling them to bypass authorization checks and execute multiple unauthorized withdrawal transactions. Users who had previously granted unlimited token approvals to the affected SwapNet contract were the primary targets. The stolen funds were quickly converted into stablecoins and ETH before being routed through privacy services, significantly hindering recovery efforts.

### Impact and Response

The total estimated loss ranges between $15.5 million and $16.8 million, impacting hundreds of high-value accounts. The assets compromised included Ether (ETH), USDC, and DAI.

Upon detecting the anomalous activity, the Matcha Meta team immediately paused all trading and integration services linked to SwapNet. In an official statement released Saturday morning, the platform confirmed the external nature of the vulnerability: “This incident was not a breach of Matcha Meta’s core infrastructure, but a successful attack on the integrated SwapNet contract dependency. We have fully isolated the affected contract and are urging all users to revoke existing permissions immediately.”

Matcha Meta is currently collaborating with law enforcement and security auditing firms to trace the stolen assets and formulate a compensation plan for affected users. The incident serves as a stark reminder of the security risks inherent in relying on interconnected third-party smart contracts within complex DeFi architectures.

Source: Matcha Meta breach tied to SwapNet exploit drains up to $16.8M