SwapNet suffers attack with a loss of $17 million; DEX aggregator authorization mechanism becomes a security risk again

On January 26, news broke that the on-chain decentralized exchange aggregator SwapNet suffered a major smart contract attack, resulting in the theft of approximately $16.8 million in crypto assets, reigniting concerns over DeFi security risks. Blockchain security firm PeckShield disclosed that the attack was related to the SwapNet routing contract called via Matcha Meta (a meta-aggregator developed by the 0x team).

The attack occurred on the Base network, where the hacker first exchanged about $10.5 million USDC for approximately 3655 ETH, then bridged the funds to the Ethereum mainnet. This type of “cross-chain transfer” is often used to extend the tracking path, making it more difficult to freeze or recover the funds.

Matcha Meta later clarified that its core system was not compromised, and the affected users were mainly those who had disabled the 0x one-time approval mechanism. This security feature was originally designed to limit continuous access of contracts to user assets, but some users disabled it to improve transaction convenience, thereby directly authorizing underlying aggregator contracts, including SwapNet’s router. This entry point was exploited by the attacker.

Matcha Meta stated that it has collaborated with the SwapNet team to address the issue, and the relevant contracts have been temporarily disabled. They also urged users to immediately revoke all aggregator approvals under non-one-time approval frameworks, especially for SwapNet’s router contract, to avoid further risks.

This incident once again exposes the long-standing contradiction between “convenience and security” in DeFi. One-time approval, while increasing operational steps, can significantly reduce the likelihood of ongoing theft; whereas unlimited approval improves transaction efficiency but amplifies losses if the contract is compromised.

Meanwhile, on the same day, the Ethereum mainnet also experienced a vulnerability related to a closed-source, unverified contract, affecting about 37 WBTC, further amplifying market concerns over contract transparency and auditing mechanisms. SwapNet has not yet announced whether it will compensate users, but it is foreseeable that security reviews surrounding DEX aggregators and approval models will be significantly strengthened in 2026.