SwapNet, a decentralized exchange aggregator, lost approximately $13.43 million in cryptocurrency assets after attackers exploited a compromised router contract that had been granted persistent token approvals by users who disabled a key security feature.
What Happened: DEX Aggregator Exploit
Security firm PeckShield reported the attack, which targeted SwapNet-linked activity accessible through Matcha Meta, a meta DEX aggregator built by the 0x team. The vulnerability affected users who had opted out of 0x's One-Time Approval system, granting direct permissions to underlying aggregator contracts.
On the Base network, the attacker converted roughly $10.5 million in USDC (USDC) into approximately 3,655 Ether (ETH) before bridging the funds to Ethereum (ETH).
The maneuver is a common tactic used to complicate tracking efforts.
"We are aware of an incident with SwapNet that users may have been exposed to on Matcha Meta for those who turned off One-Time Approvals," Matcha Meta said in a statement. The platform identified SwapNet's router contract (0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e) as the most urgent approval for users to revoke.
Also Read: South Korean Prosecutors Lose $47M Seized Bitcoin To Phishing Attack
Why It Matters: Persistent DeFi Vulnerabilities
The incident underscores a fundamental tension in decentralized finance between convenience and security. One-Time Approvals require users to authorize each transaction individually, reducing persistent attack surfaces but adding friction for frequent traders. Unlimited approvals offer speed at the cost of granting smart contracts ongoing access to user funds.
SwapNet has not released a technical post-mortem or indicated whether affected users will receive compensation.
The same day, security auditor Pashov flagged a separate Ethereum mainnet exploit involving roughly 37 WBTC (WBTC), worth over $3.1 million, linked to a closed-source, unverified contract deployed just 41 days earlier.
About a month ago DeFi community was shocked by Trust Wallet hack.
Trust Wallet confirmed that approximately $7 million in cryptocurrency was stolen through a compromised browser extension update. The breach affected only version 2.68 of the Chrome extension, which was released on Dec. 24. Luckily, mobile wallet users remained unaffected. Changpeng Zhao, founder of Binance, which owns Trust Wallet, said the wallet would compensate all affected users.
Updated Jan. 27 to reflect corrected figures on user losses from the exploit, based on newly released data from Matcha.
Read Next: Why Are Whales Buying Seeker While Smart Money Sells?
