SwapNet, a decentralized exchange aggregator, lost approximately 16.8 million dollars in cryptocurrency assets after attackers exploited a compromised router contract to which users had granted persistent token permissions by disabling a key security feature.
What happened: vulnerability on a DEX aggregator
The security company PeckShield reported the attack, which targeted the activity related to SwapNet accessible via Matcha Meta, a meta-aggregator of DEX developed by the 0x team. The vulnerability affected users who had disabled the 'one-time approval' system of 0x, granting direct permissions to the underlying aggregation contracts.
On the Base network, the attacker converted approximately $10.5 million into USDC (USDC) for about 3,655 Ether (ETH) before transferring the funds to Ethereum (ETH).
This maneuver is a common tactic used to complicate tracing efforts.
"We are aware of an incident involving SwapNet that some Matcha Meta users who had disabled unique permissions may have been exposed to," Matcha Meta stated in a statement. The platform identified the router contract of SwapNet (0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e) as the most urgent permission that users need to revoke.
Also read: South Korean Prosecutors Lose $47M Seized Bitcoin To Phishing Attack
Why it matters: persistent DeFi vulnerabilities
The incident highlights a fundamental tension in decentralized finance between convenience and security. Unique permissions require users to validate each transaction individually, which reduces the persistent attack surface but adds friction for frequent traders. Unlimited permissions offer speed at the cost of continuous access of smart contracts to users' funds.
SwapNet has not yet released a post-mortem technical report nor indicated whether affected users will be compensated.
On the same day, security auditor Pashov reported another vulnerability on the Ethereum mainnet involving approximately 37 WBTC (WBTC), worth over $3.1 million, related to a closed and unverified contract deployed just 41 days earlier.
About a month ago, the DeFi community was shocked by the hacking of Trust Wallet.
Trust Wallet confirmed that approximately $7 million in cryptocurrency was stolen via a compromised update of the browser extension. The vulnerability only affected version 2.68 of the Chrome extension, released on December 24. Fortunately, mobile app users were not affected. Changpeng Zhao, founder of Binance, owner of Trust Wallet, stated that the wallet would compensate all affected users.
Next read: Why Are Whales Buying Seeker While Smart Money Sells?