SwapNet Hack

On January 25, 2026, SwapNet and Aperture Finance suffered a combined $17 million exploit across Ethereum, Arbitrum, Base, and BSC when attackers exploited an arbitrary call vulnerability in non-open-source contracts to abuse existing token approvals and execute transferFrom calls, draining $13.41M from SwapNet-related contracts and $3.67M from Aperture Finance-related contracts, with users who opted out of "One-Time Approvals" particularly at risk.

BlockSec Phalcon detected a series of coordinated attacks targeting victim contracts deployed by two creators across multiple chains. The attackers exploited an arbitrary call capability in non-open-source contracts that allowed them to abuse existing token approvals users had granted to these protocols. By leveraging this vulnerability, the attackers executed transferFrom calls to drain assets from any address that had previously approved these contracts.

The attack primarily targeted SwapNet's router contract (0x616000e3…23757e), with the vulnerability appearing to be an arbitrary call function that permitted unauthorized fund transfers. On Base alone, the attacker swapped approximately 10.5 million USDC for 3,655 ETH and began bridging funds to Ethereum. Users who had disabled Matcha Meta's "One-Time Approvals" feature were especially vulnerable, as their approvals persisted and could be exploited.

The two deployer addresses identified were 0x9cb8d9Ba…8514BA (associated with SwapNet, losing ~$13.41M) and 0xbeef63AE…0B3112 (associated with Aperture Finance, losing ~$3.67M). SwapNet immediately disabled their contracts upon discovery, and both Matcha Meta and security researchers urged users to revoke all approvals to these aggregator contracts, particularly those outside of 0x's One-Time Approval contracts.