Matcha Meta discloses SwapNet breach; $16.8M drained as token approvals abused

On January 25, 2026, Matcha Meta warned that users who disabled One-Time Approvals may have been exposed through its SwapNet integration. By January 26, 2026, the platform said it was investigating while about $16.8 million had been drained via direct token approvals, with SwapNet contracts temporarily disabled and funds moved from Base to Ethereum.