SwapNet Breach Steals $16.8M in Crypto on Matcha Meta

A security breach in the SwapNet smart contract, integrated with the decentralized exchange aggregator Matcha Meta, resulted in the theft of approximately 16.8 million dollars in cryptocurrency assets on Sunday, primarily affecting users on the Base network.

Blockchain security firms PeckShield and CertiK confirmed the exploit involved an arbitrary call vulnerability in SwapNet's contract, which allowed the attacker to execute unauthorized transfers of tokens approved by users. The majority of the stolen funds consisted of 10.5 million dollars in USDC stablecoin, which the attacker swapped for about 3,655 ETH on Base before bridging portions to the Ethereum network. PeckShield tracked the on-chain movements, noting the attacker's use of multiple wallet addresses to drain assets and complicate recovery efforts. CertiK identified initial losses around 13.3 million dollars in USDC, though subsequent analysis aligned with the higher total reported by PeckShield.

Matcha Meta, developed by the 0x team, stated that the vulnerability originated in SwapNet, one of its liquidity providers, and did not affect its core infrastructure. The company emphasized that only users who disabled the...