What happened
SwapNet's smart contracts were exploited on January 25, 2026. Matcha Meta's post-mortem attributes $13.43M to SwapNet across 18 users; larger external estimates included the separate, unrelated $3.4M Aperture Finance incident.
Technical root cause
SwapNet accepted insufficiently validated user-supplied execution inputs, allowing an attacker to replace the expected router or pool with a token address and reach a low-level call with attacker-controlled calldata. The victim contract then executed approvedAsset.transferFrom(victim, attacker, amount) against approvals previously granted to SwapNet.
How it happened
- The attacker targeted users who had disabled Matcha Meta's One-Time Approval safeguard and granted direct or infinite approvals to SwapNet.
- In a representative Base transaction, malicious inputs invoked SwapNet's arbitrary-call function, caused USDC.transferFrom() to run in the victim-contract context, and drained approved assets; the attacker then moved proceeds across chains.
Protocol details
Classification
Access Control / Input Validation
Protocol Type
Trading App
Implementation language
Solidity
Protocol links
Website
@0xswapnet
Exploit Transaction
0xc15df1d131e98d24aa…5b6404dd57
Market Context at Time of Hack
Token Price at Hack
$0.1091
Market Cap at Hack
$789K
Reported loss / token market cap
100.00%
Protocol Links
Evidence
- report @PeckShieldAlert incident report x.com
- report @Phalcon_xyz incident report x.com
- report @matchametaxyz incident report x.com
- analysis DeFiLlama defillama.com
- analysis Matcha Meta: SwapNet Incident Post Mortem meta.matcha.xyz
- analysis BlockSec: SwapNet arbitrary-call analysis blocksec.com
- analysis Revoke.cash: SwapNet exploit record revoke.cash
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
