Incident Overview
On January 25, 2026, SwapNet and Aperture Finance suffered a combined $17 million exploit across Ethereum, Arbitrum, Base, and BSC when attackers exploited an arbitrary call vulnerability in non-open-source contracts to abuse existing token approvals and execute transferFrom calls, draining $13.41M from SwapNet-related contracts and $3.67M from Aperture Finance-related contracts, with users who opted out of "One-Time Approvals" particularly at risk.
BlockSec Phalcon detected a series of coordinated attacks targeting victim contracts deployed by two creators across multiple chains. The attackers exploited an arbitrary call capability in non-open-source contracts that allowed them to abuse existing token approvals users had granted to these protocols. By leveraging this vulnerability, the attackers executed transferFrom calls to drain assets from any address that had previously approved these contracts.
The attack primarily targeted SwapNet's router contract (0x616000e3…23757e), with the vulnerability appearing to be an arbitrary call function that permitted unauthorized fund transfers. On Base alone, the attacker swapped approximately 10.5 million USDC for 3,655 ETH and began bridging funds to Ethereum. Users who had disabled Matcha Meta's "One-Time Approvals" feature were especially vulnerable, as their approvals persisted and could be exploited.
The two deployer addresses identified were 0x9cb8d9Ba…8514BA (associated with SwapNet, losing ~$13.41M) and 0xbeef63AE…0B3112 (associated with Aperture Finance, losing ~$3.67M). SwapNet immediately disabled their contracts upon discovery, and both Matcha Meta and security researchers urged users to revoke all approvals to these aggregator contracts, particularly those outside of 0x's One-Time Approval contracts.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to SwapNet, these are the critical security checks that could have prevented this incident (January 2026).
- Verify all logic paths related to Unlimited Approval Exploit / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next SwapNet
The SwapNet hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.